If your vendor is not on this list

It is very likely already covered, and the names above are not the mechanism. Caver reads the published standard, not the badge on the cabinet. A controller nobody here has heard of that speaks Modbus/TCP, DNP3, IEC 60870-5-104, EtherNet/IP, S7comm, BACnet or OPC UA is decoded the day it appears on the network. An EHR nobody has heard of that emits FHIR AuditEvent or IHE ATNA works on day one. Any imaging device or archive that is DICOM-conformant is seen without its vendor being involved at all.

That is the whole reason this list is shorter than you expect: a vendor connector has to be written once per vendor, and it breaks the first time a product is renamed.

And where something genuinely is not covered, it gets built. Custom collectors are ordinary work here rather than a special request. If a system matters to you and nothing off the shelf reads it, say so during the trial.

OPC UA

Caver consumes OPC UA. How much of a session it can read depends on how that session is secured, and it is worth stating precisely because the claim is made loosely across this market.

Under SecurityPolicy None the traffic is in the clear and decodes like any other protocol. Under Sign or SignAndEncrypt the message bodies are protected, and Caver reads them when you provide the key material, the same arrangement any passive decoder needs for an encrypted session. Nothing here defeats the security of your OPC UA deployment, and no vendor should tell you otherwise: a passive tool either has the keys or it does not.

Without keys, the session itself is still visible and still useful: endpoints, certificate exchange, the policy in force, and the shape and timing of the conversation. Caver states which of the two it got rather than presenting partial visibility as complete, and it treats a session running SecurityPolicy None as a finding in its own right, because on a plant network that is exactly what it is.

Two things Caver will not do, and one it cannot

It will not write to a medical device or a control system. Not as an advanced option, not with a waiver, not when an operator asks it to. Three independent mechanisms enforce that, because the failure mode is an infusion pump or a ventilator: the response engine refuses any address on a clinical or control network before a request is built; the analysis code for that equipment is forbidden by an automated test from importing a network package at all; and the protocol decoders have no transmit path, also asserted by test. Some products in this space advertise that they flag or optionally correct. We deliberately do not.

It will not read an image. Caver reads the DICOM conversation, not the picture. The parser stops at the pixel data, which is both a privacy decision and the reason imaging monitoring costs no meaningful storage.

It cannot invent the care relationship. The most valuable field in an EHR audit record is the recorded reason an access was legitimate. CEF, LEEF and IHE ATNA have no field for it. FHIR AuditEvent can carry it, and only does when the sending system populates it. Where it is missing, behavioral detection degrades to counting, and Caver reports that it degraded rather than presenting a confident number.

How collection works · caver-industrial · Talk to us about your estate