Discovery and the inventory
Safetybits builds your inventory by finding devices on the network and gradually learning more about each one. The process is designed for OT environments where stability matters more than speed, and it never writes to or reconfigures the devices it finds.
Passive observation
The sensor starts by watching. It listens to the network traffic arriving on its monitoring interface and identifies devices from the conversations it sees. A device that sends or receives any traffic on the monitored segment will appear in the inventory without the sensor ever contacting it directly. This is the safest form of discovery, and it runs continuously.
Active identification
To learn more about each device, the sensor also performs lightweight identification steps. It sends standard network requests (the same kind any device on the network would send) to check which addresses are active and what services they offer. These are low-volume, read-only operations. They do not change device configurations, inject commands, or interfere with running processes.
The identification sequence works like this:
- The sensor determines which addresses on the network are reachable, using standard network protocols (ARP on the local segment, ICMP for broader reach).
- It resolves hostnames so devices appear with a recognizable name rather than just an IP address.
- It checks which network services each device offers by looking for open TCP and UDP ports. This is how the platform knows, for instance, that a device runs a web interface on port 80 or speaks Modbus on port 502.
- From the combination of open services, response characteristics, and MAC address, the platform identifies the device type, operating system, and manufacturer.
Vendor-specific enrichment
Once the platform recognizes a device’s manufacturer, it can ask deeper questions using protocols the device already speaks. A Siemens device, for example, may expose S7, a miniweb HTTP interface, or SNMP, and the platform tries each in turn and uses whichever the device answers, returning its exact model, order number, firmware version, and serial number. A Beckhoff controller will respond to ADS requests. A Teltonika router will respond to SNMP.
Safetybits supports over 20 vendor families this way, including Siemens, Moxa, Rockwell, Beckhoff, Cisco, Fortinet, and Aruba/HP. Every one of these queries is a read-only request using the device’s native protocol. The sensor asks for identification data and nothing more.
Why some devices show partial data
Enrichment depends on what each device is willing and able to share. A device behind a firewall may not respond to identification requests. A device from a manufacturer the platform does not yet support will appear with its IP and MAC address, but without model or firmware details. As support for new vendors is added, existing resources gain more detail automatically at the next discovery cycle.
From discovery to inventory
The inventory is the result of this process: a list of resources, each with whatever the sensor was able to learn. New devices appear as soon as they are detected, but the full security evaluation (findings, vulnerabilities, compliance) runs at the next snapshot. See Snapshots and change detection for how and when that happens.