Access Gate watches the traffic it sees and raises an alert when something looks off — a rule triggered on an enclave flow, an unexpected service on a zone, a device that suddenly goes silent. You do not have to write detection content from scratch: the product ships with a curated library of rules tuned for industrial and hybrid networks.
What Detection Covers
Access Gate combines three sources of signal:
| Source | What it catches | Where the signal comes from |
|---|---|---|
| Flow rules (Snort) | Known-bad payloads and protocol abuse inside enclave traffic | Live inspection of flows on overlay interfaces |
| Alert library | Common operational misconfigurations and security hygiene issues | Ships with the product, enabled by default |
| Network zones | Activity that crosses a trust boundary it should not | Zones you define in Settings |
Each signal lands in the same Alerts view, with enough context (asset, user, enclave, flow) to triage without pivoting between tools.
Built-in Alert Library
The product ships with an opinionated list of default alerts. They cover situations you want to know about on day one:
- A new asset appeared on a monitored zone.
- A device that used to talk stopped talking (missing-asset detection).
- A service started listening on a port it never listened on before.
- A flow crossed a zone boundary that should have been isolated.
- A TLS session fell back to a weak cipher.
You can silence or tune any library alert from the Alerts page.
Configure Rules
How to enable specific Rules in your Access Gate
- Navigate to Rules
- Toggle [Rule] on or off.
Rule hits appear in the enclave's activity timeline and in the global Alerts view.
How to forward alerts to a SIEM
- Navigate to Rules
- Click Configure Forward in the top right
- Enter the specific ip:port combination that will receive a rsyslog flow of alerts.
Network Zones
Zones are how you tell Access Gate which parts of the network should or should not talk to each other. Once a zone is defined, any flow crossing a boundary is scored and logged, and rules can fire on the crossing itself — not just on the payload.
See Network zones for detection for how to define zones and attach policy to them.