CMMC-Ready NDR for Industrial Infrastructure
ML detection on OT and IoT protocols. Built for compliance.
Built on the OCCAM detection engine — predictive behavioral detection that catches what signatures miss. Air-gap native. No cloud. No telemetry. The plant's data stays at the plant.
Each lens is a different way to catch a threat, layered across the license tiers. Anomalies, Behavioral, and Performance are ML/statistical — the engine pipeline below zooms into how they work. All five compound on the unified Detections page.
Zooming into the Anomalies, Performance, and Behavioral lenses above: iForest scores population outliers, Odometry tracks each host's drift from its own baseline, and OCCAM tokenizes behavior before its HMM predicts the attack sequence. Arrows show how output feeds the next layer; together they turn a stream of mystery scores into a single predictive alert. (Suricata Alerts and IP Reputation are the other two lenses — signature and lookup detections, not ML.)
An Isolation Forest — an unsupervised ML algorithm that scores each host's behavioral profile against the current population, trained online each run. Catches what signatures don't: encrypted threats, novel malware, custom tooling.
anomaly_score in [0 .. 1] per flowA per-asset baseline built online with Welford's streaming mean/variance. Each 15-minute window is scored by z-score — standard deviations from the host's own running mean — and windows that deviate, or breach SLA, are flagged. The same machinery catches network reliability issues and the early signal of host compromise.
Every 15 minutes, for every asset, OCCAM aggregates window stats and emits tokens — short labels representing observed behavior categories — each with a surprisal score in bits and an ATT&CK tactic. Translates raw drift into a security narrative an analyst can actually read.
Note: Rockfish OCCAM is a behavioral tokenizer, not the public OCCAM-rules YAML grammar at sigmahq.io. Same name, different thing.
encrypted-ratio-high, unusual-port-mix, slow-handshake, …A Hidden Markov Model over the OCCAM token sequence per asset. Named for Occam's razor: when several attack paths could explain the observed sequence, pick the simplest. The Viterbi algorithm scores how strongly the recent sequence resembles a known attack path.
suppressed / investigate / present / elevatedThe Radial Sonar is the at-a-glance situational view: every flow plotted by protocol (spoke) and by risk (radius). The radius is the compounded output of every engine — one screen where a host on the perimeter means "look here now." It answers where; the swimlane below answers who.
elevated. Outer-ring perimeter, where your eye lands first.The dashed threshold ring is the operator's risk-cutoff knob — everything outside it deserves attention. Time-window control replays the last 1–60 minutes so you can scrub through an unfolding incident frame by frame.
See a Sonar DemoWhen a host lands on the perimeter, the Detections page is where you work it. Each detection lens becomes a lane and time runs left to right — when bright cells line up vertically, multiple independent engines are firing on the same host at the same moment. That agreement is what separates a real incident from a single noisy detector.
Deploy Rockfish NDR in minutes. Single binary. No dependencies. Full pipeline.
Now we want to prove it.
We are looking for defense contractors and C3PAOs to deploy Rockfish NDR in a production environment at no cost. Slots are limited.
Requirements are simple: you run it, we support it, you tell us what you think. If that sounds like a fair trade, let's talk.