Home
Guardian
Learn how Guardian provides comprehensive asset inventory and network visibility for OT and IoT environments.
User Guide
Information and resources about the main features of Guardian, and the tasks that you can do from the user interface (UI).
Arc in Guardian
Arc™ is a host-based sensor that detects and defends against malicious or compromised endpoints, and insider attacks. You can use Arc sensors to aggregate data for analysis and reports, either on-premises, or in the Vantage cloud.
Deployment settings
Configure Arc deployment parameters that will be included in downloaded Arc bundles. These settings define how Arc will behave when deployed from Guardian.
Endpoint
The Endpoint page lets you configure the settings for your Arc deployment.

Guardian
Learn how Guardian provides comprehensive asset inventory and network visibility for OT and IoT environments.
- Introduction
  An overview of Guardian.
- Installation Guide
  Information and resources on how to install Guardian, and the different options and settings that are available.
- Administrator Guide
  Information and resources about the Administration section of Guardian, and the tasks that you can do in this part of the software.
- User Guide
  Information and resources about the main features of Guardian, and the tasks that you can do from the user interface (UI).
  - Sensors
    The Sensors page lets you view all of the sensors that you have in your system.
  - Alerts
    The Alerts page shows all the latest alerts in the system. It lets you view the alerts in different modes, and carry out actions on the alerts.
  - Assets
    The Assets page shows all the physical components and systems in the local network environment and their associated details. It also lets you perform actions on those assets. Depending on the nodes and components involved, assets can range from a simple personal computer to an operational technology (OT) device.
  - Queries
    You can use the Nozomi Networks Query Language (N2QL) syntax to create complex data processes to obtain, filter, and analyze lists of information from the Nozomi Networks software.
  - Smart Polling in Guardian
    The Smart Polling page lets you view and manage Smart Polling.
  - Arc in Guardian
    Arc™ is a host-based sensor that detects and defends against malicious or compromised endpoints, and insider attacks. You can use Arc sensors to aggregate data for analysis and reports, either on-premises, or in the Vantage cloud.
    - Architecture
      It is important to understand the different architecture possibilities that are available with Arc.
    - Arc in Guardian
      The Arc button in the Guardian Web UI lets you access the different pages for Arc.
    - Deployment
      The Deployment page shows a table of all the devices available for Arc deployment.
    - Deployment settings
      Configure Arc deployment parameters that will be included in downloaded Arc bundles. These settings define how Arc will behave when deployed from Guardian.
      - Upstream
        The Upstream page lets you configure the settings for your Arc deployment.
      - Endpoint
        The Endpoint page lets you configure the settings for your Arc deployment.
      - Network sensor
        The Network sensor page lets you configure the settings for your Arc deployment.
      - Other
        The Other page lets you configure the settings for your Arc deployment.
    - Node points
      The Node points page shows data points that are collected over time, and represent the state of the target machine.
  - Network
    The Network page gives you access to multiple pages that show nodes, links, sessions in tabular format and graphs and traffic in a graphical format.
  - Graph
    The Graph pages gives a graphical representation of the nodes in the environment.
  - Process
    Process is a set of repeatable functions that a business does to deliver a core value.
  - Reports
    The Reports page lets you manage, generate, schedule and view reports.
  - Assertions
    The Assertions page shows all the assertions and lets you configure them.
  - Time machine
    Time machine lets you load a snapshot, which is a previously saved state, and go back in time, to analyze the data from a past situation. You can load a single snapshot and use the platform as usual or load two snapshots and compare the user interface to highlight changes.
  - Vulnerabilities
    The Nozomi Networks software continuously discovers vulnerabilities in monitored assets.
  - Administration
  - Personal settings
    The personal settings page lets you do actions that are specific to your profile.
- Maintenance Guide
  Information about the maintenance tasks of Guardian, to help you administer and maintain the solution in a production environment.
- Print format documentation
  A list of all the print-format documentation that is available for Guardian.

Endpoint

The Endpoint page lets you configure the settings for your Arc deployment.

TBD — Figure 1. Endpoint page

Node points

Enable this option to extract detailed asset information as node points. These can be plotted over time to visualize endpoint activity.

Unusual behaviors (Windows only)

This lets you enable/disable Sigma rules for local behavior analysis.

Valid assets (using ARP)

Enable this option to use the local address resolution protocol (ARP) table to confirm media access control (MAC) addresses for connected assets.

Enable Use static entries to include user-defined static ARP table entries in the validation. Only enable this if the static entries are trusted.

USB devices (Windows only)

This lets you enable/disable universal serial bus (USB) detections.

Malware

The Malware checkbox lets you enable protection mode and select from the Action to perform on malware detection dropdown. This lets you set the action that Arc will take when it finds a malicious file.

You can choose from these options:

Only alert: Receive an alert with no further action
Quarantine: Move the malicious file to the quarantine folder, which is located in the Arc installation folder
Delete: Immediately delete the malicious file. Once deleted, the files cannot be recovered

Restore default

Once the settings have been saved, you can use this button to restore the default configuration.