Axiom Border

Axiom Border is a network and asset monitoring probe you install at the edge, close to the equipment it watches. It is not an agent that reports to a cloud: it observes, decides and acts on its own, on the machine, and centralising into OpenGate is something you switch on afterwards if a fleet-wide view is useful to you.

It works fully disconnected, and it does four jobs that normally take four separate tools:

flowchart TB
    A["Your network<br>servers · devices · PLCs"]:::ext --> P["<b>Axiom Border</b>"]
    P --> M["Metrics<br>and alarms"]
    P --> S["Security<br>assessment"]
    P --> C["Web console"]
    M --> OG["OpenGate<br><i>optional</i>"]:::ext
    S --> OG

    classDef ext fill:#e9edfa,stroke:#486ac9,color:#101010
  1. Monitors the hosts and devices around it, collecting metrics and keeping the history locally.
  2. Raises alarms on its own, from rules you define, with no need to reach a server first.
  3. Assesses security — discovers assets, scans ports and services, detects vulnerabilities, queries SNMP and observes traffic without emitting a packet. It carries its own suite of 57 industrial protocol checks and recognises sixteen OT protocols as it listens, four of them carried directly over Ethernet with no IP address involved. That is what sets it apart from a general-purpose scanner.
  4. Integrates with OpenGate when you want a fleet-wide view — and keeps working exactly the same when the link is down.
Start here

Presenting Axiom Border explains the product in seven short readings: what it is, the loop it runs, its four probes, how passive and active analysis hand over to each other, how an event becomes an actionable alarm, the models that run on the probe, and the security posture it deploys with.

Read that first. The rest of this section is how to operate what it describes.

What it needs to run

Axiom Border installs from a single self-contained package that carries everything it depends on, so the target machine needs no internet access and no manual preparation.

Requirement
Operating system Ubuntu 22.04 or 24.04, Debian 12 or 13 — 64-bit
Machine 2 CPU cores and 2 GB RAM minimum; 4 cores and 4 GB recommended
Disk 4 GB free minimum, 20 GB recommended for history
Network Access to the network you want to monitor
Internet Not required

It installs in one of two roles — central, the complete node, or monitoring, a remote node that reports into a central one. Only the central role carries the metrics database and the components behind the optional anomaly-detection feature.

Where to go next

New to the product: Presenting Axiom Border, and then Configuration to adapt a running probe to your environment.

Every catalogue the probe carries — vulnerabilities, manufacturers, OIDs and MIBs — where each comes from and how to keep it current: Catalogs: vulnerabilities, OIDs, MIBs and more.

Getting a running probe to do something useful: Metrics and monitoring to bring data in, Security assessment to examine what is around it, and Alarms and rules to react automatically.

Integrating with other systems: MQTT and OpenGate.

Before you scan industrial equipment

Axiom Border can perform checks that write to industrial devices. This is switched off by default and needs two separate confirmations to enable — but the responsibility for authorising it is yours. Read OT/ICS vulnerability scanning before enabling anything against a live plant.

Index