Home
Guardian
Learn how Guardian provides comprehensive asset inventory and network visibility for OT and IoT environments.
Administrator Guide
Information and resources about the Administration section of Guardian, and the tasks that you can do in this part of the software.
Administration
Settings
Firewall integration
The Firewall integrations page shows all the firewall integrations and lets you add new ones.

Guardian
Learn how Guardian provides comprehensive asset inventory and network visibility for OT and IoT environments.
- Introduction
  An overview of Guardian.
- Installation Guide
  Information and resources on how to install Guardian, and the different options and settings that are available.
- Administrator Guide
  Information and resources about the Administration section of Guardian, and the tasks that you can do in this part of the software.
  - Administration
    - Administration page
      The administration page lets a user with administrator privileges configure settings and do other tasks.
    - Settings
      - Security control panel
        The Security control panel page shows an overview of the current status of the learning process and lets you configure the features that manage the: learning, security profile, zones, alerts tuning, and alert closing options.
      - Features
        The Features page shows an overview of the current status of system features configuration and lets you fine tune specific values.
      - Users management
        The Users management page shows all the pages that you need to let you manage authentication and authorization policies for users and groups.
      - CLI
        The CLI page lets you change configuration parameters and perform troubleshooting activities.
      - Dashboards
        The Dashboards page lets you create and configure widget-based dashboards that provide information about your network. The dashboards created here will show on the Guardian home page, and give an overview of the monitored environment.
      - Threat Intelligence
        The Threat Intelligence page lets you manage packet rules, YARA rules, Sigma rules, structured threat information expression (STIX) indicators and vulnerabilities to provide detailed threat information.
      - Custom fields
        The Custom fields page lets you create a custom field to the Nodes (All-In-One CMC only) and Assets tables. A custom field lets you add information that might be relevant to your organization, and cannot be extracted from network traffic.
      - Discovery
        Enables lightweight network announcements to detect neighboring devices. Use this option to initiate device discovery within the local network. Discovery is disabled by default.
      - Data integration
      - Firewall integration
        The Firewall integrations page shows all the firewall integrations and lets you add new ones.
        Alert-based firewall rule creation
        Guardian can create firewall rules dynamically in response to specific alerts, providing event-driven network enforcement independent of node learning state.
        Configure Barracuda
        Configure Guardian firewall integration with the Barracuda firewall.
        Configure Cisco ASA
        Configure Guardian firewall integration with the Cisco ASA firewall.
        Configure Cisco FTD
        Configure Guardian firewall integration with the Cisco FTD firewall.
        Configure Cisco ISE
        Configure Guardian firewall integration with the Cisco ISE firewall.
        Configure Fortinet FortiGate
        Configure Guardian firewall integration with the Fortinet FortiGate firewall.
        Configure Palo Alto Networks v10.1
        Configure Guardian firewall integration with the Palo Alto Networks v10.1 firewall.
        Configure Stormshield SNS
        Configure Guardian firewall integration with the Stormshield SNS firewall.
        Configure TXone EdgeOne / OT Defense Console
        Configure Guardian firewall integration with the TXone EdgeOne / OT Defense Console firewall.
        Configure Check Point R81.20
        Configure Guardian firewall integration with the Check Point R81.20 firewall.
      - Credentials manager
        The Credentials manager is a tool that lets you centralize the management of monitored endpoints to make it easier to create, delete, or update the credentials that are needed to access those endpoints.
      - Zone configurations
        The Zone configurations page shows all the zone configurations in your environment and lets you add new zone configurations and edit them.
      - Synchronization settings
        The Synchronization settings page lets you customize the parameters related to Vantage or Central Management Console (CMC).
      - Alert playbooks
    - System
- User Guide
  Information and resources about the main features of Guardian, and the tasks that you can do from the user interface (UI).
- Maintenance Guide
  Information about the maintenance tasks of Guardian, to help you administer and maintain the solution in a production environment.
- Print format documentation
  A list of all the print-format documentation that is available for Guardian.

Firewall integration

The Firewall integrations page shows all the firewall integrations and lets you add new ones.

Firewall integrations page — Figure 1. Firewall integrations page

General

Guardian lets you configure firewall integrations. Guardian discovers, identifies, and learns the behavior of assets on your network. Through integration with the firewall, unlearned nodes and links are automatically blocked through block policies. Block policies are not created for nodes and links in the learned state.

Note:

For some firewall integrations, Guardian supports session kill.

After the integration has been set up, policies are produced and inserted in the firewall. The policies are displayed in the Policies section.

Firewall rules strategies

For supported integrations, you can choose how Guardian decides when to create firewall rules. Two strategies are available:

Block active alerts: Guardian creates link-blocking policies when specific alerts are triggered. Rules are generated based on real-time detection events, not on node learning state. For more details, see Alert-based firewall rule creation.
Block unlearned: Guardian creates block policies for nodes and links that have not yet been learned. This is the default behavior.

Features

Firewall integrations only work when, in the Security control panel, the:

Detection approach is set to Strict
Phase switching is set to Protecting

It does not work when the policy for zones is set to override the Protecting and Strict mode. In this mode, we can see new nodes, but they are not learned.

If the global learning policy is set to Adaptive Learning and Learning, and a zone is set to Adaptive Learning and Protecting, we see new nodes, but they are not learned, however links to new nodes are learned automatically.

Live / refresh

The Live icon lets you change live view on, or off. When live mode is on, the page will refresh approximately every five seconds.

Add

The + icon lets you add a new firewall integration.