Next-Generation Enterprise OT/ICS Security Analysis & Asset Discovery Platform
IRONFLOW is a production-grade, modular security assessment framework engineered for sensitive Industrial Control Systems (ICS) and Operational Technology (OT). It provides critical visibility, risk quantification, and deep protocol dissection without compromising operational safety or reliability.
Important
Safety-by-Design: IRONFLOW operates in a non-intrusive SAFE MODE by default. It utilizes benign protocol handshakes and read-only operations to ensure zero impact on industrial processes.
- 🌐 Comprehensive OT Support: Native dissection for 7+ protocols (Modbus, S7, DNP3, BACnet, EtherNet/IP, IEC-104, OPC UA).
- 🔍 Hybrid Discovery: Combined real-time passive PCAP analysis and safe active fingerprinting.
- 📊 OT-Aware Risk Engine: Sophisticated scoring based on industrial exposure and configuration posture.
- 🗺️ Topology Intelligence: Automatic mapping of industrial network relationships and protocol flows.
- 🎨 Premium UX: Modern CLI interface powered by
richwith colorized tables, progress tracking, and branding. - 💼 Enterprise Reporting: High-fidelity HTML and JSON reports for stakeholders and CI/CD integration.
# Clone the enterprise repository
git clone https://github.com/ismailtsdln/ironflow.git
cd ironflow
# Set up a clean environment
python3 -m venv venv
source venv/bin/activate
# Install production dependencies
pip install -r requirements.txtIRONFLOW is invoked as a standard Python module for maximum portability:
python3 -m ironflow scan --target 192.168.1.0/24 --reportpython3 -m ironflow analyze --pcap captures/plant_floor.pcap --reportpython3 -m ironflow risk --target 192.168.1.50python3 -m ironflow topology --target 192.168.1.0/24 --export network_map.jsonIRONFLOW follows a strictly modular architecture to enable safe expansion:
ironflow.core: Safety guards, plugin orchestration, and persistence logic.ironflow.protocols: Isolated protocol engines for safe identification.ironflow.discovery: Orchestration for both active network sweeps and passive capture analysis.ironflow.risk: YAML-driven risk scoring rules and calculation engine.ironflow.reporting: Template-based generator for HTML/JSON security audits.
AUTHORIZED USE ONLY.
Industrial environments are fragile. IRONFLOW is designed for defensive auditing, blue-teaming, and posture management.
- Permission: Ensure you have explicit, written authorization before scanning any OT network.
- Liability: The developers assume no responsibility for downtime or damages resulting from improper configuration or use.
- Warning: Always use
--dangerouswith extreme caution in production environments.
Distributed under the MIT License. See LICENSE for more information.
Developed with focus on Industrial Resilience.