To meet the CAF objective C for security monitoring an IDS was needed. Claroty was the choice as the amount of backing it has from OT vendors.

Asset discovery, showing data flows, detecting potential breaches.

The amount of fine tuning that you need to get claroty deployed.

It has lots of unique features and quirks that make it valuable - however cannot ignore that it also has some fundamental challenges around asset discovery, be that due to miss configuration or the platform itself. However, it was configured by Claroty themselves and therefore you would expect configured correctly.

Interface is clean and unique - it deploys relatively simple onto the network - ability to bring in ta vast array of assets into its clean view again makes things easier from a visualisation perspective.

Under the hood some things must be a miss - we benchmarked against a competitor and there were clear devices deployed on the network that Claroty missed. this obviously proved to be a significant concern.