Sentinel CPV

1. Product Overview

Sentinel CPV is a passive OT security verification overlay. It watches what your operations layer already produces — Modbus register writes, historian telemetry, work orders and Management-of-Change (MOC) permits — and verifies every control action across four deterministic layers: protocol conformance, semantic binding to your P&ID, operational authorization, and physical response. The result is a short queue of Evidence-Chain alerts you can act on, and silence where authorized maintenance should be silent.

It is an overlay, not a replacement: Sentinel CPV maximises the ROI of the sensors, historians and network monitoring you already run, and never interferes with the process.

2. The Problem Sentinel CPV Solves

Industrial plants drown in alerts that don't mean anything:

• The 99 % false-positive engine. Up to 99 % of raw alerts from unsupervised network anomaly detectors in industrial environments are false alarms — the overwhelming majority of anomalies are legitimate maintenance, tuning, calibration and startups.
• Valid packets, hostile intent. Targeted ICS attacks (PIPEDREAM, TRITON) use perfectly valid protocol framing and authorized function codes. Packet inspectors see nothing.
• Statistical blindness. Incumbent platforms baseline process values statistically but never ask whether the action was authorized (MOC/permit) or whether the plant physically complied — so plant changes trigger nuisance alarms while stealthy setpoint manipulation inside the "normal" envelope sails through.
• The encryption horizon. CIP Security, S7comm-plus TLS and OPC UA SignAndEncrypt are erasing raw payload visibility at SPAN ports — platforms that must read plaintext registers are approaching obsolescence.
• Compliance pressure. NERC CIP-015-1, TSA SD-02, NIS2, IEC 62443 and NCA OTCC-1 all demand continuous OT monitoring with audit-grade evidence.

Sentinel CPV answers the three questions nobody else asks together: what does this write mean, was it authorized, and did the plant physically respond?

3. How It Works

Every observation traverses the same deterministic path. Nothing is sampled, learned or guessed: identical input always produces an identical verdict, so any alert can be replayed and audited years later.

4. Key Capabilities

• Semantic register binding — raw Modbus offsets become engineering meaning (0x0066 → FCV-204_OUT → 170.96 %) via a per-plant register map (CSV import with downloadable template).
• DEXPI P&ID knowledge graph — import your plant topology once; Sentinel CPV traces causality from controller to loop to valve to vessel and computes the blast radius of every command.
• MOC/permit clamping — active work orders and Management-of-Change permits are ingested read-only; authorized maintenance is absorbed, not alerted. This single behaviour removes the benign noise that makes other OT tools ignorable.
• Evidence-Chain alerts — raw frame, register bindings, physical correlation, operational context and a five-component confidence score whose weights are printed (graph deviation ×0.15, parsing fidelity ×0.15, protocol conformance ×0.20, authorization failure ×0.25, physical residual ×0.25 — admin-tunable).
• MITRE ATT&CK for ICS mapping — alerts carry technique ids (T0855, T0836, T0838, T0858 family) mapped during adjudication.
• Rogue device detection — communication baselines flag sources that have no business writing to your controllers.
• Physical corroboration — historian response (flow, temperature, level) confirms or contradicts the commanded effect; contradiction is the highest-severity path.
• Optional AI narratives — evidence-clamped, schema-constrained incident narratives for junior analysts. Disabled unless explicitly configured; never a dependency.
• Collector registry — mint, reveal-once and revoke collector credentials per plant.
• Operator console — overview KPIs, alert queue, P&ID topology viewer, register map, work orders, collectors, billing and admin — all light-theme, keyboard-friendly, reduced-motion aware.

5. Product Tour

The how-it-works documentation at /how-it-works walks the real product step by step with genuine screenshots of a running deployment — the same attack narrative shown below is what the demo seed replays.

8. Compliance & Standards Support

Sentinel CPV produces the evidence surfaces these mandates audit:

11. FAQ

Is Sentinel CPV another network IDS? No. It consumes decoded observations and verifies them semantically, operationally and physically. Protocol conformance is one of five confidence components, not the product.

Does it need raw packets? No. The ingest contract is decoded metadata, which keeps working as industrial encryption (CIP Security, S7comm-plus TLS, OPC UA SignAndEncrypt) removes payload visibility at the switch port.

Will it interfere with my process or the SIS? It cannot. There is no blocking, reset, firewall or controller-write path in the product. It observes, verifies and notifies — humans act.

What does it do about the 99 % false-positive problem? It attacks the cause: operational context. Actions covered by an active MOC ticket or work permit are absorbed as authorized maintenance with low confidence instead of being alerted.

How confident is each alert? You see the exact arithmetic — five named components with their weights, printed on every alert. Admins can retune the weights per plant.

What happens if AI makes a mistake in a narrative? The LLM is evidence-clamped: it is prompted only with the stored evidence chain, schema-constrained on output, and disabled entirely unless you configure a key. The detection pipeline never depends on it.

Does it work air-gapped? Yes — local PostgreSQL, local storage, local auth fallback, AI off by default. Zero external calls unless you enable them.

What protocols are supported today? Modbus TCP end to end (the reference ICS protocol), with the observation contract ready for EtherNet/IP (CIP), S7comm and OPC UA collectors.