Described are platforms, systems, and methods for real-time enrichment of vertices, edges, and related data within a graph database. The platforms, systems, and methods maintain a graph database comprising a representation of a current state of an automation environment comprising a plurality of data sources, wherein the data sources are represented as vertices in the graph database and relationships between the individual data sources are represented as edges in the graph database; operate a plurality of software agents, each software agent configured to perform operations comprising: applying an algorithm to identify patterns in the graph database; and generating a specific data enrichment based on one or more identified patterns; and contribute the generated data enrichment back to the graph database.

Described are platforms, systems, and methods for mapping data found in connected equipment from a manufacturer's selected schema, format, and protocol to a normalized data model. The platforms, systems, and methods identify a plurality of data sources associated with an automation environment; retrieve data from at least one of the identified data sources; generate a plurality of data source mapping profiles, each data source mapping profile specific to a particular data source configuration; maintain a data store comprising the plurality of data source mapping profiles; select a data source mapping profile specific to the at least one identified data source configuration; and apply an algorithm to map the retrieved data to a predetermined ontology based on the selected data source mapping profile for the at least one identified data source.

Described are platforms, systems, and methods to discover subtended devices through introspection of executive or supervisory controllers. The platforms, systems, and methods maintain a plurality of introspection directives, each introspection directive comprising a sequence of instructions specific to a communications protocol, the sequence of instructions comprising instructions to send at least one command to at least one controller associated with an automation environment in accordance with the communications protocol, instructions to receive a response to the at least one command, and instructions to parse the response; identify an appropriate introspection directive for the at least one controller; and execute the sequence of instructions with respect to the at least one controller to perform operations comprising: sending at least one command to at least one controller; receiving a response; and parsing the response.

Described are platforms, systems, and methods for real-time enrichment of vertices, edges, and related data within a graph database. The platforms, systems, and methods maintain a graph database comprising a representation of a current state of an automation environment comprising a plurality of data sources, wherein the data sources are represented as vertices in the graph database and relationships between the individual data sources are represented as edges in the graph database; operate a plurality of software agents, each software agent configured to perform operations comprising: applying an algorithm to identify patterns in the graph database; and generating a specific data enrichment based on one or more identified patterns; and contribute the generated data enrichment back to the graph database.

Described are platforms, systems, and methods to discover relationships among equipment in automated industrial or commercial environments by cycling each individual piece of equipment while observing sensors in all other equipment in order to measure how each part reacts to each other part. The platforms, systems, and methods identify a plurality of data sources associated with an automation environment; issue one or more commands to cycle a current data source in the a plurality of data sources; monitor the automation environment for events or state changes in the data sources; detect one or more events or one or more state changes in one or more other data sources in the a plurality of data sources; and determine one or more relationships between the current data source and the one or more other data sources.

Described are platforms, systems, and methods to automatically discover, extract, map, merge, and enrich data found in on-premises in automated industrial and commercial environments and cloud systems for purposes of providing developers access to normalized, merged, and enriched data through an API. The platforms, systems, and methods identify a plurality of data sources associated with an automation environment; retrieve data from at least one of the identified data sources; apply a first algorithm to map the retrieved data to a predetermined ontology; merge the mapped data into a data store comprising timeseries of the mapped data; apply a second algorithm to identify patterns in the merged data and enriching the data based on one or more identified patterns; and provide one or more APIs or one or more real-time streams to provide access to the enriched data.

Described are platforms, systems, and methods to discover relationships among equipment in automated industrial or commercial environments by looking for synchrony in state changes among the equipment. The platforms, systems, and methods identify a plurality of data sources associated with an automation environment; detect one or more events or one or more state changes in the data sources; store the detected events or state changes; detect synchrony in the detected events or state changes by performing operations comprising: identifying combinatorial pairs of data sources having an event or state change within a predetermined time window; and conducting pairwise testing for each identified combinatorial pair of data sources by applying an algorithm to the stored detected events or state changes; and determine one or more relationships for at least one identified combinatorial pair of data sources.

Method include receiving banner information from one or more queries of a network connecting a set of devices, wherein the banner information of one or more of the devices includes common vulnerability and exposure identifiers (CVEs) and the banner information of one or more of the devices does not include a CVE, identifying the devices based on the banner information including classifying devices without known CVEs by a device type, determining vulnerability scores for the devices with known CVEs based on retrieved CVE information, and determining vulnerability scores for the devices without CVEs based on a series of exploitability and impact parameter estimates associated with the device type classifications. Some methods include estimating a cyberattack vulnerability risk for the devices using the determined vulnerability scores.

An system (100) for updating firmware on an industrial device (130) includes a user interface device (110) storing a computer program (200) with executable instructions (210, 212, 214, 220, 222); one or more industrial devices (130) comprising firmware; and a communication network (120) interfacing with the user interface device (110) and the industrial device (130) and adapted to transmit data, wherein the computer program (200) of the user interface device (110) comprises instructions (210) to scan the communication network (120) and to identify an industrial device (130) that requires an update of the firmware, and wherein the computer program (200) of the user interface device (110) comprises further instructions (214) to update the firmware on the industrial device (130) via the communication network (120) after establishing communication with the industrial device (130). Further, a method (300) and a computer program (200) for updating firmware on industrial devices (130) are provided.

A method may include determining a termination time for a virtualization services manager and various termination times for various host devices operating in a drilling management network. The virtualization services manager may generate a virtual machine or a software container that implements a virtualization service on a network layer that controls a drilling operation. The method may further include transmitting, by a shutdown manager, a time delayed termination command to the virtualization services manager and various time delayed termination commands to the host devices. The method may further include terminating operations at the virtualization services manager based on the termination time and in response to the shutdown manager terminating operations. The method may further include terminating operations at the host devices based on the termination times and in response to the virtualization services manager terminating operations.