What's new and coming in FireSight OT

The current version is 0.3.0, and the FireSight OT guides describe it.

New in 0.3.0

Feature	What it does
Remote desktop in the browser	RDP and VNC (Windows engineering stations, HMI panels) open in a browser window, with clipboard and Ctrl+Alt+Del. No client needed.
Browser terminal	SSH, Telnet and serial consoles open in a terminal in the browser. SSH works with passwords or keys; a device's SSH key is trusted the first time and any change is flagged.
Session transcripts	Every browser terminal session is recorded as text, kept for 90 days and linked from the audit log for administrators. See Security and audit.
Serial consoles	USB console cables or USB-to-RS232 adapters on the Cloud Connector reach routers, switches, firewalls, drives and PLC service ports. One person at a time, with Send break. In the browser or through the client (PuTTY, SecureCRT). Sites can turn them off on their own device.
4G/5G mobile data	A USB modem or modem HAT with a data SIM, as the main connection or a backup. Set up when the Cloud Connector is created (APN, SIM PIN). See Cloud Connectors.
Mobile data saving	On mobile data a Cloud Connector stays on standby, using about 15 MB a month, and opens its tunnel within seconds when someone needs it. Status and alerts keep working. Data used this month is shown per connector.
Maintenance mode	Hold a site's alerts for 1 hour to 1 week, with a note. Anything still down afterwards is alerted then. Alert rules can be snoozed.
HTTPS certificate from the console	The Hub gets and renews a free Let's Encrypt certificate from Security & settings.
Safer port forwards	Static forwards can be limited to VPN users with access to the site, and the console and Ember warn about forwards open to the whole internet.
Industrial hardware	Step-by-step support for the CC-5i, on a compute module with built-in eMMC storage.

0.4.0, in beta

Built and in beta testing (lab-tested, not yet run at a customer site). Customers get it with 0.4.0.

Feature	What it does
Machine VLANs	One Cloud Connector serves up to 20 machine VLANs on a trunk port, all of which may use the same addresses. See Switch settings for Cloud Connectors.
Time server for the machines (NTP)	The Cloud Connector gives PLCs, HMIs and PCs the time, kept in step with the Hub; the Hub's time source can be chosen.
API and integrations	A public REST API, signed webhooks and syslog export (CEF, LEEF, JSON over TLS), with one-click setup for Dragos, Claroty, Nozomi Networks, Armis, Tenable and Forescout. See API and integrations.
Detect (licensed add-on)	Threat detection on 8 GB Cloud Connectors, with incidents linked to remote sessions, one-click responses (end session, suspend user, lock down site), a device inventory, and signed rule packs from FireSight. See Detect: threat detection.
MQTT bridge (one way)	Machines publish to the Cloud Connector, and the Hub forwards the allowed topics to the company's MQTT broker or cloud (HiveMQ, EMQX, Mosquitto, AWS IoT Core, Azure Event Grid). Each site's topics get a prefix, messages are kept through outages, and nothing can come back into the plant. Included in the base licence. See MQTT bridge.
Sign-in protection and fail2ban	The Hub blocks addresses with repeated failed sign-ins, and fail2ban on the server (installed by default) blocks them at the firewall. See Sign-in protection and fail2ban.
Mirror port	Shown on the Cloud Connector's Device network tab and its setup page.
Signed Mac client	In every release again.

Upgrading to 0.4.0: the Hub as usual; Cloud Connectors with Update software. Detect needs the 0.4.0 SD card image (it carries the detection engine), or on an older card:

sudo apt install -t bookworm-backports suricata ieee-data && sudo systemctl mask suricata

Planned

Not built yet. Details may change, and we don't give dates.

Session video recording of Remote Desktop and VNC sessions, played back from the audit log.
SMS alerts, with your own SMS account (for example ClickSend or Twilio).
Mobile app with push alerts and status.
Ember with AI.
Update checks: the Hub sees new versions and upgrades itself and its Cloud Connectors.
Detect: normal-behaviour learning (alerts on new conversations and unusual commands) and weekly reports.
fail2ban settings in the console, to turn it on or off and adjust it without the command line.

Getting a version

Get 0.3.0 from Downloads → FireSight OT, and upgrade as in Install and upgrade FireSight OT. To try the 0.4.0 beta, contact support.