Industrial Cybersecurity · App
See every device on your OT network, without disrupting it.
OTChef pairs a lightweight agent with a web console to discover, identify and map the assets on industrial networks.
Purdue Model view
- L5Enterprise
- L4Site business
- L3.5Industrial DMZ
- L3Site operations
- L2Area supervisory
- L1Basic control
- L0Process
Devices OTChef can't classify are shown as "Unclassified" rather than guessed.
How it works
Listen, never touch
The agent only listens. A single agent and console deliver a live inventory without sending a packet onto your control network.
STEP 1
Agent listens
Lightweight agent captures traffic on the network. It sends nothing onto the wire.
STEP 2
Console receives
Traffic streams to the web console via Kafka or a console relay.
STEP 3
Assets appear
Devices are added to the Asset Master with IP, MAC, hostname and NIC vendor.
STEP 4
Identify and assess
Vendor, model and firmware are read, then matched to known CVEs.
Passive asset discovery
- Zero-impact traffic capture
- Automatic Asset Master with IP, MAC, hostname, NIC vendor
- Optional active ARP scan for quiet devices such as an idle PLC. Off by default, enabled per group
Device identification
- Role inferred from Modbus read/write patterns: sensor, actuator or PLC/controller
- Inferred values are labelled and never overwrite confirmed data
- Every connection labelled with its application protocol
- TLS server names extracted from handshakes without decrypting anything
Asset governance
- VLAN Master: define expected networks so unexpected devices stand out
- Filter builder across assets, packets and connections
- Dashboard with fleet-wide summary statistics
OT device identification
Devices tell you who they are
OTChef reads vendor, model, firmware and serial number from the identification exchanges devices already make.
Modbus/TCP
Vendor, model, firmware and serial from identification exchanges
EtherNet/IP (CIP)
Self-reported device identity
S7comm
Self-reported device identity
DNP3
Self-reported device identity
BACnet
Self-reported device identity
Vulnerability intelligence
Fix what is being exploited first
Identified devices are matched against NIST's National Vulnerability Database, then cross-referenced with CISA's Known Exploited Vulnerabilities catalog.
- Known CVEs per asset
- Known-exploited flagging to prioritise active threats
- Dedicated vulnerability dashboard
- Scheduled scan keeps results current
How a finding is built, step by step.
Network diagrams
From traffic and configs to a map
Interactive topology
Topology views per asset and per agent, with connection labels showing protocols.
Network Architecture from configs
Upload Cisco IOS/IOS-XE and Palo Alto PAN-OS configurations. OTChef builds the VLAN, zone, interface and subnet map, and correlates devices through shared subnets, static routes and CDP/LLDP neighbours.
Purdue Model view
Devices placed on Purdue levels, including the Industrial DMZ at Level 3.5. Anything it can't classify stays "Unclassified".
Fleet management and policy control
Run the agents like a fleet
- One-command enrolment: agents self-enrol into groups with an onboarding key
- Live agent health: online, stale and offline, with status history and email alerts on down and recovery
- System information per machine: OS, resources, interfaces, users, processes
- Agent downloads for Windows and Linux, plus a Windows system tray icon
- Interface exclusions keep sensitive segments out of capture
- Uninstall protection: removal requires a console-issued passphrase
Group policy
- SystemInfoOS, resources, interfaces, users and processes
- Packet capturePassive traffic capture streamed to the console
- Remote operationsConsole-initiated operations on the agent
- ARP scanOptional active scan for quiet devices. Off by default
Running agents pick up policy changes in about a minute, without a restart. Try the toggles: this is an interactive illustration.
Built for real deployments
Cross-platform agent
A single native binary for Windows and Linux, with no runtime dependencies on the target machine.
Flexible transport
Stream via Kafka (TLS and SASL supported) or relay through the console.
Role-based access
Admin and user roles, with admin-only settings.
Docker Compose
Gets the full stack running quickly. Light and dark themes included.
Screenshots
OTChef in action
FAQ
Frequently asked questions
Will OTChef disrupt my industrial network?
No. The agent listens to traffic and sends nothing onto the wire. The only active feature is an optional ARP scan, which is off by default and must be enabled per group.
How does it identify devices?
It reads vendor, model, firmware and serial number from Modbus/TCP, EtherNet/IP (CIP), S7comm, DNP3 and BACnet identification exchanges. When a device never identifies itself, a role is inferred from Modbus read/write patterns and clearly labelled as inferred.
Does it decrypt encrypted traffic?
No. It extracts TLS server names from handshakes so encrypted sessions show the hostname they connect to.
Where do the vulnerabilities come from?
Identified devices are matched against NIST's National Vulnerability Database and cross-referenced with CISA's Known Exploited Vulnerabilities catalog.
Which platforms does the agent support?
Windows and Linux, as a single native binary. The console is a web application.
Can I keep sensitive segments out of capture?
Yes. Exclude interfaces per machine, and turn capture features on or off per group.
More apps
Let's build
Ready to engineer your next product?
Book a free 30-minute discovery call with a senior engineer, or send the details and we'll come back with a plan, an honest estimate and a team.
- hello@pixelgridtech.in
- Reply within one business day