CMDNOC
UTC --:--:--CONTROL CENTER
Start a conversation

CmdNOC SiteWatch

A small box on your network that spots an attack while it is still happening.

One appliance, six jobs, led by intrusion detection. It watches your core traffic for an attack in progress, keeps a live inventory of every device on your LAN, checks the systems you depend on every few minutes, finds weaknesses from the inside, checks what your site exposes to the internet every day, and sets a trap that only an intruder would spring. Everything it sees reports to the CmdNOC Control Center.

Form factor: small appliance or virtual machine  ·  Ports: one, plus a listen-only port for intrusion detection  ·  Inbound connections: none

03:00outside-in check · 3 ports answer from the internet · same as yesterday
06:02intrusion sensor · mirror link healthy · quiet overnight
08:52intrusion rule matched · tablet → address on a public blocklist
08:53AI triage: act · tablet named from the inventory
09:15intrusion rule matched · laptop scanning the server subnet
09:17decoy touched · file share browsed · same laptop
09:17alert emailed · case opened in the Control Center
Example readings. Times and labels are illustrative; the alert types are the real ones.

Six jobs

What a SiteWatch does all day

Each job runs on its own schedule and feeds the same dashboard, so one appliance covers intrusion, inventory, uptime, vulnerability and internet exposure for the whole site.

Job 1 · Watches the wire Now live

Network intrusion detection

Your core switch sends a mirror copy of the traffic on one link, usually the one to your internet gateway, to a second port on the SiteWatch. That port has no address and never transmits. The SiteWatch checks that traffic against tens of thousands of known attack patterns: scanning, malware calling home, passwords sent in plain text, devices talking to addresses on public blocklists.

  • It sits beside your traffic, never in its path. If the appliance stops, your network does not notice.
  • An AI analyst reads each serious alert first and marks it act, watch or noise, with its reasoning. An engineer makes the call.
  • Each alert names both devices from the SiteWatch inventory, so you see which computer it was, not just an address.
  • Known-harmless patterns are silenced one rule at a time, each with a written reason, so the queue stays readable.
The other jobs see your devices. This one sees what they do. It starts only under its own written authorization.
Job 2 · Knows every device

Device inventory and new-device alerts

The SiteWatch listens passively for devices announcing themselves on the LAN and keeps a running inventory: address, hardware maker, first seen, last seen. Nothing is scanned to build it.

  • The first day is a baseline. After that, any device never seen before raises an alert within minutes.
  • You mark devices as known with a label and an owner. Known devices stay quiet.
  • A weekly sweep adds open services, software identity and the operating system to each device.
Answers the question every audit asks: what is on this network?
Job 3 · Watches what matters

Uptime probes from inside the building

You name the systems that matter: the server, the gateway, the printers, the camera recorder, an internal web app, a certificate. The SiteWatch checks each one every five minutes from inside your network, the way your staff reach them.

  • Two failed checks in a row raise a high alert and an email.
  • The first good check clears it, and the outage stays on record.
  • Certificates are watched for expiry two weeks out.
Outside monitoring cannot see a printer behind your firewall. This can.
Job 4 · Finds weaknesses

Internal vulnerability scanning

On a schedule you approve in writing, the SiteWatch runs authenticated vulnerability scans against your internal systems and files the findings with the rest of your compliance evidence.

  • Internal scans are the half of PCI DSS that an outside scan cannot cover.
  • Findings are tracked to closure in the Control Center, with history.
  • Scope is written down and signed before anything is scanned.
Scanning is the only job that touches your systems, and it runs only inside its signed scope.
Job 5 · Catches intruders

The decoy

A fake server with a login page and a file share full of tempting documents. Nothing legitimate on your network has a reason to touch it, so any contact is worth a look.

  • A login attempt, a file share browsed, a document opened: each is an alarm with the source and what was tried.
  • Ransomware looks for file shares first. The share it finds here is the trap.
  • The decoy can answer but can never start a connection of its own.
Most breaches are found months later by someone else. This one calls you in minutes.
Job 6 · Looks in from outside Now live

Outside-in exposure watch

The SiteWatch reports your site's public address, and every day a short-lived vantage point on the internet tries every port at that address and asks the ones that answer what they run. The result is the outside view: exactly what an attacker on the internet can reach at your site, kept beside the inside view the other jobs build.

  • The first check is a baseline. After that, a port that opens to the world is a high alert, one that closes is noted, and a service that changes is flagged.
  • The vantage point is created for the check and destroyed afterward; its name on the internet identifies us.
  • It runs only under the signed scope that names your public address, and the Control Center re-checks that scope before every run.
  • Firewall forwards you meant to have are matched against the firewall's own rules, so the report names the forward, not just the port.
Inside monitoring cannot tell you what the internet sees. This can, and it tells you the day it changes.

Trust

How it is built

The SiteWatch is a security device, so it is built to be the hardest thing on your network to abuse.

No open doors
The SiteWatch accepts no inbound connections from the internet. The Control Center reaches it over a private, encrypted mesh that nothing else can join. Nothing on your network connects out to us.
Hardened by default
Every service runs in a locked-down container: read-only, no extra privileges, memory and process limits. The decoy sits behind an outbound guard that lets it reply and never start a connection, re-checked every thirty seconds.
Keeps alerts, not contents
The inventory comes from devices announcing themselves on the LAN. Intrusion detection reads a mirrored copy of traffic only where a separate written authorization covers it, and keeps alerts and connection details, never packet contents. The raw log stays on the appliance and rolls over; the Control Center keeps the grouped alerts and deletes resolved ones after 30 days. No agents on your computers, no change to your network.
Looks in only with permission
The outside-in check scans only the public address written into your signed scope, from a machine that exists for the few minutes of the check and is then destroyed. Its reverse DNS name identifies CmdNOC, so anyone who looks up the scanning address sees who it was.
You see what it sees
Inventory, probe history, scan findings, intrusion alerts, the outside view and decoy alarms all land in the CmdNOC Control Center, where you review them with us. Alerts go to email as they happen.
Watched itself
If a SiteWatch stops reporting, that is an alert too. A quiet network and a dead sensor look the same from outside, so the Control Center tells them apart.

Deployment

From box to baseline in a week

STEP 1

Place it

A small quiet appliance on one network port, or a virtual machine on your own hypervisor. Either way, one address on your LAN.

STEP 2

Baseline

For the first 24 hours it records every device it hears without alerting. You mark the known ones.

STEP 3

Name what matters

Together we list the systems to probe, choose the decoy's address and the subnet the weekly sweep covers, pick the switch link to mirror for intrusion detection, and confirm the public address the outside-in check will watch.

STEP 4

Sign the scope

Vulnerability scanning, intrusion detection and the outside-in check start only after the written authorization for each is on file, with its scope and dates.

What you get

Evidence, not just alerts

Live

A device inventory that is always current, with the unknowns at the top.

Weekly and daily

A weekly sweep that refreshes every device's services and operating system, and a daily outside view of every port that answers from the internet, each naming what appeared or vanished.

On schedule

Internal vulnerability findings filed as compliance evidence, tracked to closure.

As it happens

Alerts for attack patterns on the wire, new devices, outages, expiring certificates, a port newly open to the internet, and any touch of the decoy.

On record

Every outage and every alarm kept with its start, end and who acknowledged it.

In production

SiteWatch appliances are deployed at client sites today, covering school campuses, medical practices, houses of worship and offices.

One appliance. Intrusion detection, inventory, uptime, vulnerabilities, the outside view, and a trap.

Ask us for a SiteWatch deployment plan for your site. Scoping takes one conversation; the baseline takes a day.

Ask for a deployment plan