Integrated IT/OT Security Operations Center with Intrusion Detection (IDS)

Overview

This service provides 24/7 security monitoring across IT and OT networks, combining a cloud-based intrusion detection system (IDS)*1 with Yokogawa’s OpreX IT/OT Security Operations Center (SOC) services. It enables early detection and response to potential cybersecurity threats while providing centralized visibility across industrial networks 24/7.

When a threat is detected by the IDS, alerts are communicated in real time to the customer’s Factory Security Incident Response Team (FSIRT) to support timely investigation and response. Regular reports provide security stakeholders with visibility into monitoring activities, detected incidents, and ticket resolution status.

Deployment is streamlined through standardized implementation procedures. A Nozomi Networks sensor is connected to a mirror port on the monitored network and securely linked to the cloud environment, enabling efficient and scalable security monitoring across OT environments and multiple locations.

*1) The service supports Nozomi Networks Vantage, a SaaS-based platform for centralized cybersecurity monitoring and management of OT environments.

IDS image 1

Cybersecurity Risks and Threats in OT Environments

Service Features

OT Security Monitoring Service Utilizing Nozomi Vantage	This service is a security monitoring service utilizing Nozomi Networks' "Nozomi Vantage." There is no need to purchase IDS products separately. Customers who sign up will receive Nozomi Sensor hardware and Nozomi Vantage, which operates on the cloud, through a subscription model.
*Simple Installation Work 2**	We install Nozomi Sensor hardware at the location specified by the customer. You can start monitoring by connecting the monitoring port of the Nozomi Sensor hardware to the mirror port of the network under monitoring, and connecting the management port to Nozomi Vantage on the cloud via the internet. Minimize implementation work and quickly build a security monitoring environment. *2) On-site work is not included in this service. Please handle this yourself or request a separate request from our company.
Incident Detection and Notification	Nozomi Sensor and Nozomi Vantage monitor your OT network in real time. When an incident is detected, we notify the customer (FSIRT representative) by email. We support our customers in responding quickly to incidents.
Regular Report	YOKOGAWA's SOC analysts create a report summarizing Nozomi Vantage's monitoring status, incident ticket status, and improvement suggestions. We report to the client's security officer.

Cloud-Based Security Monitoring Service Utilizing Nozomi Networks Vantage

Service Scope

Services and Activities Included in Scope	Nozomi Vantage License Nozomi Sensor Hardware OT Network Monitoring (Threat and Anomaly Detection with Nozomi Vantage) Email notifications when incidents are detected Regular reports on monitoring status and incident response status
Services and Activities Not Included	On-site work (installing Nozomi sensors, network connection) Setting up existing network devices (such as mirror port settings) Investigation and analysis of logs not subject to Nozomi Sensor monitoring On-site investigation of incidents Incident containment, recovery response, and implementation of permanent measures ※ If any of the above activities are required, we will discuss them separately to confirm feasibility and the appropriate scope of support.

Services and Activities Included in Scope

Nozomi Vantage License
Nozomi Sensor Hardware
OT Network Monitoring (Threat and Anomaly Detection with Nozomi Vantage)
Email notifications when incidents are detected
Regular reports on monitoring status and incident response status

Services and Activities Not Included

On-site work (installing Nozomi sensors, network connection)
Setting up existing network devices (such as mirror port settings)
Investigation and analysis of logs not subject to Nozomi Sensor monitoring
On-site investigation of incidents
Incident containment, recovery response, and implementation of permanent measures

※ If any of the above activities are required, we will discuss them separately to confirm feasibility and the appropriate scope of support.

System Configuration

Nozomi Sensor:
Hardware for network monitoring installed in your OT environment. Communication is collected from the mirror port of the network device under surveillance, and the analysis results are sent to Nozomi Vantage.
With this service, you can select the following models according to the scale of your monitoring.

NS-20 (for medium-sized networks)
NS-1 (for small networks)

Nozomi Sensor is offered on a subscription model to customers who have signed up for this service.

	Number of nodes	Throughput	Number of monitoring ports	Surveillance port
NS-20	5,000	500Mbps	7x1000Base-T	1x1000Base-T
NS-1	1,000	500Mbps	7x1000Base-T	1x1000Base-T

(Source: https://www.nozominetworks.com/platform/technical-specifications）

Nozomi Vantage:
A SaaS-based security platform that enables asset visibility, threat detection, and anomaly analysis in OT environments on the cloud. Integrate and manage multiple Nozomi Sensors to centrally monitor your OT environment. License fees are determined based on the number of assets under monitoring.

This service is offered to customers who have signed up for it on a subscription model.
(Reference: https://ja.nozominetworks.com/platform/vantage）

Maintenance Services

Nozomi Networks Maintenance:
This service provides maintenance services for Nozomi Sensor hardware. In the unlikely event of a hardware failure, we respond quickly by providing replacement machines or preemptive replacements, minimizing the impact on your monitoring operations.

Cloud maintenance:
We handle patching and software upgrades for Nozomi Vantage and Nozomi Sensor. We minimize operational and maintenance work by customers while maintaining security features and a stable monitoring environment that can respond to the latest threats.

Service Providers & Contract Terms

You can choose between a one-year or multi-year contract period.
Since this service is provided on a subscription model, cancellation during the contract period is not possible.

Price Model

This service is a subscription-based service consisting of an initial implementation fee and a monthly service usage fee.

Initial implementation costs include hardware costs, setup costs, transportation costs, and other expenses related to building the monitoring environment.
The monthly service fee is determined based on the number of monitored assets, IDS, and user accounts.

OpreX IT/OT Security Operations Center (SOC)

Managed IT/OT cybersecurity services for threat detection and remediation

Looking for more information on our people, technology and solutions?