CMMC-Ready NDR for Industrial Infrastructure
ML detection on IT, IoT, and OT protocols. Built for compliance.
Built on the OCCAM detection engine , predictive behavioral detection that catches what signatures miss. Air-gap native. No cloud. No telemetry. Your network. Your data.
Each lens is a different way to catch a threat, layered across the license tiers. Anomalies, Behavioral, and Performance are ML/statistical, the engine pipeline below zooms into how they work. All five compound on the unified Detections page.
Zooming into the Anomalies, Performance, and Behavioral lenses above: iForest scores population outliers, Odometry tracks each host's drift from its own baseline, and OCCAM tokenizes behavior before its HMM predicts the attack sequence. Arrows show how output feeds the next layer; together they turn a stream of mystery scores into a single predictive alert. (Suricata Alerts and IP Reputation are the other two lenses, signature and lookup detections, not ML.)
An Isolation Forest, an unsupervised ML algorithm that scores each host's behavioral profile against the current population, trained online each run. Catches what signatures don't: encrypted threats, novel malware, custom tooling.
anomaly_score in [0 .. 1] per flowA per-asset baseline built online with Welford's streaming mean/variance. Each 15-minute window is scored by z-score (standard deviations from the host's own running mean), and windows that deviate, or breach SLA, are flagged. The same machinery catches network reliability issues and the early signal of host compromise.
Every 15 minutes, for every asset, OCCAM aggregates window stats and emits tokens (short labels representing observed behavior categories), each with a surprisal score in bits and an ATT&CK tactic. Translates raw drift into a security narrative an analyst can actually read.
Note: Rockfish OCCAM is a behavioral tokenizer, not the public OCCAM-rules YAML grammar at sigmahq.io. Same name, different thing.
encrypted-ratio-high, unusual-port-mix, slow-handshake, …A Hidden Markov Model over the OCCAM token sequence per asset. Named for Occam's razor: when several attack paths could explain the observed sequence, pick the simplest. The Viterbi algorithm scores how strongly the recent sequence resembles a known attack path.
suppressed / investigate / present / elevatedRockfish is a passive monitoring sensor, so it delivers the continuous-monitoring and audit-record practices at the heart of a Level 2 assessment, and the visibility to verify the controls it doesn't enforce itself.
Suricata IDS, SIGMA behavioral rules, and the ML anomaly/behavioral lenses monitor every host and communication for attacks and indicators — and surface unauthorized or unusual use as it happens.
Every event is written to signed Parquet with provenance metadata baked into each file, retained for an operator-configurable window (90 days by default). Activity is traceable to hosts and assets on the wire.
Flow, TLS, DNS, and GeoIP analytics give full visibility at the system boundary — monitoring remote access and external connections, and verifying your deny-by-default boundary is actually holding.
Rockfish supports and provides evidence toward these NIST SP 800-171 practices; it does not by itself constitute CMMC certification. * Network-level attribution is to hosts and assets, not authenticated user identities. † 3.13.6 is a boundary-enforcement control; Rockfish monitors and verifies it rather than enforcing it.
Install the Rockfish NDR engine on any Debian/Ubuntu sensor — it auto-detects the platform, adds the signed APT repository, and verifies the install.
$ curl -fsSL https://docs.rockfishndr.com/install.sh | bash
Deploy Rockfish NDR in minutes. Single binary. No dependencies. Full pipeline.