macmon

Importer Data Types

• Asset Details Enrichment and Create New in Vantage

  macmon NAC supplies records including endpoint hostname, IP and MAC addresses, switch and port location, VLAN, OS fingerprint, compliance status and last-seen timestamp — to enrich existing Vantage assets and create new asset records for endpoints not yet observed on the OT network.

Joint Use Cases

• Correlating macmon signals with OT network alerts

  When Nozomi Vantage raises an anomaly alert for a device inside an OT segment, the analyst can pivot to the same asset's macmon NAC record in Vantage to review port location, VLAN assignment and last compliance check, all without leaving the Vantage investigation workflow. This cross-layer correlation surfaces whether a network-layer anomaly coincides with activity observed by macmon, reducing the time needed to confirm or dismiss an incident.

• Closing asset inventory gaps across IT and OT

  Devices recorded by macmon NAC but not yet observed by Nozomi network sensors are automatically created as new asset records in Vantage, populated with hostname, MAC, switch port location and VLAN drawn from the macmon management plane. OT operations teams can audit the resulting unified inventory to identify unmonitored or underprotected assets in industrial and critical infrastructure zones, then prioritize sensor deployment accordingly.

• Mapping network access decisions onto OT topology

  Endpoints with NAC posture decisions from macmon NAC are correlated with their observed traffic patterns in Vantage, allowing security engineers to confirm that policy enforcement at the access layer aligns with the OT segmentation model and to flag endpoints whose actual traffic contradicts their declared NAC posture.

Integration Prerequesites