Pillar
OT and IoT
The controller cannot run the laptop agent. The protocol is not HTTP. This pillar is the span and the parser. Endpoint owns the cabin laptop.
Questions about OT and IoT
Can I put EDR on the PLC?
Usually no. That is why this pillar exists. Endpoint owns the laptop in the cabin.
Is this a SIEM recap?
No. A SOC bundle may sit on a tap. The SIEM list is the console job.
Will you publish protocol attack steps?
No. Defense and parsers only.
Where does the plant VPN sit?
The path is Network. The privileged session is Identity. The parser is here.
