Freedom251 › Threat Intelligence Platforms

SİBERAT

Paid Self-hosted

What SİBERAT is

SİBERAT AX is a self-hosted security operations platform for IT and operational technology. It uses a branch sensor to analyze network traffic, industrial protocol data, and logs, then sends decisions and supporting evidence to a central brain. Raw packets and raw logs remain at the branch. Six detection surfaces are listed: NDR, OT/ICS, ITDR, deception, IDPS signatures, and agentic AI. Industrial analyzers cover BACnet, DNP3, MMS, Modbus, OPC-UA, S7comm, EtherNet/IP, GOOSE, and IEC-104. Records are normalized through 41 OCSF protocol profiles, including 19 industrial profiles, and 16 extension event classes. Queryable events, summaries, and evidence use governed retention in a columnar store. The agent operates from a defined tool catalogue, cites evidence, and applies an autonomy ceiling that can require named-operator approval. Integrations include syslog, CEF, LEEF, Windows event collection, and vendor connectors. Deployment uses two appliances. Pricing is available on request.

Who it suits

It suits critical-infrastructure, public-sector, and enterprise teams managing IT and OT environments. Its branch-and-centre design fits organizations keeping raw data at sites while sharing decisions centrally.

What it does well

Analyzes IT and OT data at branch appliances
Covers six detection surfaces
Supports numerous industrial protocols
Normalizes records to OCSF
Includes indicator enrichment and workflow automation

What to know first

Self-hosted two-appliance deployment required
Endpoint enforcement is out of scope
Long-term raw-log archiving is out of scope
No case management

Limits

Endpoint enforcement, long-term raw-log archiving, cloud hosting, and free-form model queries are outside the stated scope.

Getting started

Open the SİBERAT AX website
Request a demo, proof of concept, or architecture workshop
Deploy a sensor appliance at the branch
Deploy the brain appliance at the centre
Connect supported log formats, Windows collection, and vendor connectors
Configure central response actions and agent approvals

Verdict

SİBERAT AX combines branch-level analysis with centralized evidence and response controls. Teams needing endpoint enforcement, cloud hosting, or long-term raw-log storage should note those stated limits.

Questions

What deployment model does SİBERAT AX use?

It is self-hosted and uses two appliances: a branch sensor and a central brain.

How is raw data handled?

Raw packets and raw logs stay at the branch; the centre receives decisions and supporting evidence.

What does SİBERAT AX cost?

It is a paid product with pricing available on request.

Which industrial protocols are supported?

Listed protocols include BACnet, DNP3, MMS, Modbus, OPC-UA, S7comm, EtherNet/IP, GOOSE, and IEC-104.

Does it provide case management?

Case management is listed as unavailable, while report management and workflow automation are available.

How can prospective customers engage the maker?

Demo, proof-of-concept, and architecture-workshop requests are directed to the technical team, which says it responds within 48 hours.

Facts from SİBERAT's own pages

Agent controls: The agent uses a defined tool catalogue, cites evidence in verdicts, and has an autonomy ceiling computed from asset criticality, evidence strength, and action reversibility. · sobesoftware.com, 9 Oct 2026
Agent safeguards: The agent uses a defined tool catalogue, cites evidence in verdicts and has an autonomy ceiling that can require approval by a named operator. · sobesoftware.com, 9 Oct 2026
Data handling: The page says raw packets and raw logs stay at the branch, while decisions and evidence travel to the centre. · sobesoftware.com, 9 Oct 2026
Deployment: The stated footprint is two appliances: a sensor at the branch and a brain at the centre. · sobesoftware.com, 9 Oct 2026
Deployment footprint: The product uses two appliances: a sensor at the branch and a brain at the centre. · sobesoftware.com, 9 Oct 2026
Detection coverage: Its six detection surfaces are NDR, OT/ICS, ITDR, deception, IDPS signatures, and agentic AI. · sobesoftware.com, 9 Oct 2026
Event normalization: It describes 41 OCSF protocol profiles, including 19 industrial profiles, and 16 OCSF extension event classes. · sobesoftware.com, 9 Oct 2026
Founded: 2020 · sobesoftware.com, 28 Sept 2026
Headquarters: Çankaya, Ankara, Türkiye · sobesoftware.com, 28 Sept 2026
Industrial protocols: The product lists support for BACnet, DNP3, MMS, Modbus, OPC-UA, S7comm, EtherNet/IP, GOOSE, and IEC-104. · sobesoftware.com, 9 Oct 2026
Integrations: The page describes central response actions and vendor connectors, with intake, enrichment, and action on separate privileges; it does not name specific connector vendors. · sobesoftware.com, 9 Oct 2026
Integrations and intake: The page lists syslog, CEF, LEEF, key-value and positional log formats, Windows event collection via WEF/WEC or WinRM, and vendor connectors. · sobesoftware.com, 9 Oct 2026
Intended customers: The maker describes its solution scenarios as focused on critical infrastructure, public sector, and enterprise customers. · sobesoftware.com, 9 Oct 2026
Limits: The page says endpoint enforcement, long-term raw log archiving, cloud-hosted service, and free-form model queries are out of scope. · sobesoftware.com, 9 Oct 2026
Normalization and storage: SİBERAT AX normalizes records to OCSF and stores queryable events, summaries and evidence in a columnar store with governed retention. · sobesoftware.com, 9 Oct 2026
Notable limits: Endpoint enforcement, long-term raw-log archiving, cloud hosting and free-form model queries are listed as out of scope. · sobesoftware.com, 9 Oct 2026
OT protocols: Its industrial protocol analyzers cover BACnet, DNP3, MMS, Modbus, OPC-UA, S7comm, EtherNet/IP and GOOSE. · sobesoftware.com, 9 Oct 2026
Product scope: SİBERAT AX is an agentic security operations platform for OT and IT that analyzes data at branch appliances and provides context centrally. · sobesoftware.com, 9 Oct 2026
Raw data handling: Raw packets and logs stay at the branch; the centre receives decisions and their supporting evidence. · sobesoftware.com, 9 Oct 2026
Security: The product page lists end-to-end mTLS, tenant isolation, signed firmware updates with rollback, and leased rather than embedded secrets. · sobesoftware.com, 9 Oct 2026
Security controls: The stated controls include mTLS uplinks, tenant isolation, signed firmware updates with rollback, and leased rather than embedded secrets. · sobesoftware.com, 9 Oct 2026
Support: The maker says demo, proof-of-concept and architecture-workshop requests reach its technical team within 48 hours. · sobesoftware.com, 9 Oct 2026
Support and sales: The maker says demo, proof-of-concept, and architecture workshop requests reach its technical team within 48 hours. · sobesoftware.com, 9 Oct 2026
What it does: SİBERAT AX is an agentic security operations platform for IT and OT that analyzes network and industrial protocol data at branch appliances and sends decisions and evidence to a central system. · sobesoftware.com, 9 Oct 2026

Where SİBERAT stands on Freedom251

Threat Intelligence Platforms#31 of 32