CMDNOC
UTC --:--:--CONTROL CENTER
Start a conversation

CmdNOC SiteWatch

A small box on your network that listens, watches, and lies in wait.

One appliance, four jobs. It keeps a live inventory of every device on your LAN, checks the systems you depend on every few minutes, finds weaknesses from the inside, and sets a trap that only an intruder would spring. Everything it sees reports to the CmdNOC Control Center.

Form factor: small appliance or virtual machine  ·  Ports: one  ·  Inbound connections: none

06:12new device seen · office printer · marked known
06:4024 probes answered · gateway 4 ms · file server 10 ms
09:15new device seen · unknown laptop · not on the known list
09:17decoy touched · file share browsed · a document opened
09:17alert emailed · case opened in the Control Center
Example readings. Times and labels are illustrative; the alert types are the real ones.

Four jobs

What a SiteWatch does all day

Each job runs on its own schedule and feeds the same dashboard, so one appliance covers inventory, uptime, vulnerability and intrusion for the whole site.

Job 1 · Knows every device

Device inventory and new-device alerts

The SiteWatch listens passively for devices announcing themselves on the LAN and keeps a running inventory: address, hardware maker, first seen, last seen. Nothing is scanned to build it.

  • The first day is a baseline. After that, any device never seen before raises an alert within minutes.
  • You mark devices as known with a label and an owner. Known devices stay quiet.
  • A weekly sweep adds open services, software identity and the operating system to each device.
Answers the question every audit asks: what is on this network?
Job 2 · Watches what matters

Uptime probes from inside the building

You name the systems that matter: the server, the gateway, the printers, the camera recorder, an internal web app, a certificate. The SiteWatch checks each one every five minutes from inside your network, the way your staff reach them.

  • Two failed checks in a row raise a high alert and an email.
  • The first good check clears it, and the outage stays on record.
  • Certificates are watched for expiry two weeks out.
Outside monitoring cannot see a printer behind your firewall. This can.
Job 3 · Finds weaknesses

Internal vulnerability scanning

On a schedule you approve in writing, the SiteWatch runs authenticated vulnerability scans against your internal systems and files the findings with the rest of your compliance evidence.

  • Internal scans are the half of PCI DSS that an outside scan cannot cover.
  • Findings are tracked to closure in the Control Center, with history.
  • Scope is written down and signed before anything is scanned.
Scanning is the only job that touches your systems, and it runs only inside its signed scope.
Job 4 · Catches intruders

The decoy

A fake server with a login page and a file share full of tempting documents. Nothing legitimate on your network has a reason to touch it, so any contact is worth a look.

  • A login attempt, a file share browsed, a document opened: each is an alarm with the source and what was tried.
  • Ransomware looks for file shares first. The share it finds here is the trap.
  • The decoy can answer but can never start a connection of its own.
Most breaches are found months later by someone else. This one calls you in minutes.

Trust

How it is built

The SiteWatch is a security device, so it is built to be the hardest thing on your network to abuse.

No open doors
The SiteWatch accepts no inbound connections from the internet. The Control Center reaches it over a private, encrypted mesh that nothing else can join. Nothing on your network connects out to us.
Hardened by default
Every service runs in a locked-down container: read-only, no extra privileges, memory and process limits. The decoy sits behind an outbound guard that lets it reply and never start a connection, re-checked every thirty seconds.
Listens, does not record traffic
The inventory comes from devices announcing themselves on the LAN. The SiteWatch does not capture your traffic, does not install agents on your computers, and does not change your network.
You see what it sees
Inventory, probe history, scan findings and decoy alarms all land in the CmdNOC Control Center, where you review them with us. Alerts go to email as they happen.
Watched itself
If a SiteWatch stops reporting, that is an alert too. A quiet network and a dead sensor look the same from outside, so the Control Center tells them apart.

Deployment

From box to baseline in a week

STEP 1

Place it

A small quiet appliance on one network port, or a virtual machine on your own hypervisor. Either way, one address on your LAN.

STEP 2

Baseline

For the first 24 hours it records every device it hears without alerting. You mark the known ones.

STEP 3

Name what matters

Together we list the systems to probe and choose the decoy's address and the subnet the weekly sweep covers.

STEP 4

Sign the scope

Vulnerability scanning starts only after the written authorization is on file, with its scope and dates.

What you get

Evidence, not just alerts

Live

A device inventory that is always current, with the unknowns at the top.

Weekly

A sweep that refreshes every device's services and operating system, and names what appeared or vanished.

On schedule

Internal vulnerability findings filed as compliance evidence, tracked to closure.

As it happens

Alerts for new devices, outages, expiring certificates, and any touch of the decoy.

On record

Every outage and every alarm kept with its start, end and who acknowledged it.

In production

SiteWatch appliances are deployed at client sites today, covering school campuses, medical practices, houses of worship and offices.

Roadmap

In development

Two more jobs are being built for the same appliance. Neither is sold yet.

In development

Network intrusion detection

The SiteWatch takes a mirror of your core switch traffic on a second network port and watches for the patterns of an attack in progress: scanning, lateral movement, command-and-control beacons. Metadata only, no payload stored. Needs a mirror port and a separate written authorization, since it watches traffic rather than listening for devices.

In development

Outside-in exposure watch

The SiteWatch reports your site's public address, and our external vantage point checks it from the internet on a schedule. A port that opens to the world, or a service that changes, shows up as a diff, so the inside view and the outside view live in the same report.

One appliance. Inventory, uptime, vulnerability, intrusion.

Ask us for a SiteWatch deployment plan for your site. Scoping takes one conversation; the baseline takes a day.

Ask for a deployment plan