Twelve modules. One operator view.

Mediation Architecture

A live, interactive Purdue Model map: packet-per-second counters for every zone, an animated flow across the break-and-inspect boundary, and a "Mediation DNA Inspector" showing the last intercepted transaction, TXID, protocol, full forensic detail.

• •L4–5 Enterprise Cloud, L3.5 SILDA DMZ, L0–3 Industrial Zone, one screen
• •Mediation DNA Vault, scrolling strip of recent transaction cards
• •Export Vault button for offline review

Detection Authority

WAF and signature counters, an OT device latency heatmap, the top four MITRE ATT&CK for ICS techniques observed live, and a per-row anomaly table: asset, technique, AI score, decision, drift badge, KEV badge.

• •Five active WAF rules: honeypot paths, rate limiting, large payload, latency guard, TLS downgrade
• •Drift alerts when behaviour deviates >3σ from an asset's rolling baseline
• •Pulsing alert badge on the nav item, clears on open

Forensic Vault

The complete, searchable, cryptographically-chained ledger, not just the current session, all history. 50 events per page, full-text search by IP, technique, decision, asset, or timestamp.

• •SHA-256 chain with Ed25519 signature on every entry
• •Automatic 10 MB log rotation to archive/, nothing is ever lost
• •Export: PDF report, compliance JSON, SIEM/CEF, full history JSON/CSV

Policy Authority

Full administrative control: break-glass emergency bypass (logged), enforcement kill switch, shadow mode for a safe 30-day observation window, and live sliders for latency, anomaly-score, drift, and rate-limit thresholds.

• •Every Phase 3 feature toggle, drift alerts, TAXII/KEV feed, Ed25519, OTEL trace IDs, mTLS, HA peer monitor
• •Raw runtime-config JSON editor with live validation
• •Role selector, effect is immediate, no reload

Connection Authority

OT device registry with block/monitor/delete actions, subnet discovery across Modbus, S7comm, OPC-UA, IEC 60870-5-104, and DNP3 ports, and one-click sector templates that reset the registry and downtime benchmark together.

• •Backend target test, TCP, TLS validity, HTTP status, round-trip latency
• •Built-in OT traffic simulator, auto-starts so the detector has real events on first run

Threat Intelligence & Virtual Patching

Live CVE tracking cross-referenced against the CISA KEV catalog every six hours, plus network-layer virtual patches for legacy OT devices that can't be rebooted or taken down for maintenance.

• •Apply Patch, a protection rule active instantly, no device reboot
• •Three built-in rules: S7comm exploit block, Modbus FC 90 block, OPC-UA session hijack guard

Compliance Posture Evidence Portal

NIST 800-82 R3 (15 controls), IEC 62443 SL-2 (14 controls), and MITRE ATT&CK ICS v14 coverage, scored live from actual runtime state, not a static template. Full control inventory with green check / red X per item.

Remote Access / Vendor Portal

Zero-trust vendor access with session recording and automatic expiry, meets IEC 62443 SL-3 remote-access requirements.

• •Time-limited tokens: 30 min to 8 hr, read-only through full admin
• •Kill Session terminates immediately and logs to the forensic vault

SIEM / Alerting Hub

Bridges SILDA into your existing SOC, Splunk, Microsoft Sentinel, Slack, PagerDuty, without replacing anything you already run.

• •Syslog/CEF endpoint, Sentinel workspace ID, or a webhook with a live test send
• •Five configurable alert rules, including a daily 08:00 UTC digest

Federated Anomaly Detection

Switch a node between FL Hub and FL Site, watch the differential-privacy budget deplete per round, and promote or roll back the global model, never applied to a live detector without explicit approval.

Agentic Investigation Authority

Fires automatically on every high-confidence block. A seven-tool agent investigates, dynamically replans based on findings, and produces a severity-scored report with ranked remediation, without a human in the loop.