BlueEye watches the connections between your locations and remote units. That could be water plants, production halls or municipal sites. Measurements, flows and incidents stay on your own server. The only thing that goes out is the licence check, meaning how many agents are running.
The connection to Treatment Plant North is not responding. 100% packet loss for 6 minutes, measured from two agents at once.
Probable common cause: both plants hang off the same upstream hop (10.20.0.1), which became unstable at 03:11.
NIS2 report draft created automaticallyOne example. BlueEye gathers findings from several agents into one probable cause instead of fourteen disconnected alarms.
New flagship feature
Pick the agent closest to the problem, type the address you want to reach and what you are seeing. BlueEye runs the checks in order and names the layer the communication stops at. DNS, ARP, routing, firewall or the service itself. You get an answer, not a log to read through.
Stop sends no further rounds. A check already handed to the agent runs to the end. It cannot be cancelled halfway.
AgentWaterworks South · agent 04
Targetscada.utility.local
DiagnoseReaching a destination
What is wrongThe SCADA page will not load from the office since this morning
Example answerThe name lookup succeeds. Nothing answers after hop 3. The communication stops in routing between the core network and distribution.
The challenge
Utilities and other critical infrastructure fall under NIS2. You must be able to document that the network is monitored, and report significant incidents within fixed deadlines.
An example: the night of 12 March
14 alarms from 6 sites in two minutes. The operator on call can see that something is wrong, but not what set it off, or how many sites are actually affected.
An upstream hop (10.20.0.1) starts dropping packets. Nobody has noticed yet.
Treatment Plant North and Pumping Station West both see 100% packet loss for 6 minutes.
BlueEye can see that both sites hang off the same hop, and gathers the two findings into one probable cause, stating how many sites are affected.
Timestamps, affected sites, duration and measured cause are already in the NIS2 draft. The operator reads it through and adds to it.
It is the same incident in both panels. On the left it takes a long time before anyone knows what is wrong. On the right it is in the draft at 03:15.
The solution
BlueEye runs on-premises and single-tenant on your own hardware. Measurements, flows and incidents do not leave the building. The only thing that goes out is the licence check, meaning the number of agents, and it may be offline for 14 days. Maps and fonts can point at your own, if you want to be fully closed off.
On-premises · single-tenant
Anomalies are found with robust statistics on your own server (median and MAD z-score). No ML model, no cloud call, and each finding carries its own explanation and the data behind it. If you want incidents phrased in prose on top, a language model can be switched on (Mistral in the EU by default, other providers selectable). It is off by default and only ever sees masked summaries.
Local analysis · AI optional
When the incident happens, the draft is already written. Timestamps, affected sites, duration and measured cause are pulled in automatically. You read it through and correct it instead of writing the report from scratch. The draft is never submitted on its own.
Draft · never auto-submitted
What you get in practice
BlueEye gathers the agents' measurements into something an on-call operator can act on at night, and that an auditor can check afterwards.
Findings from several sites are gathered into one probable cause with confidence and a count of how many sites are affected. You see the incident instead of the noise.
Hop-by-hop analysis of the route with loss, latency and jitter per hop. So you can see whether the fault is with you, with the operator, or in between.
Multi-step transaction tests (http, tcp, dns, icmp) with timing per step. Measures the actual user journey, not just whether the host answers a ping.
Evidence snapshots at incidents and an Ed25519-signed, timestamped evidence manifest on every report. It can be checked offline.
Diagnostics and flows
The connection test handles most questions. If the fault keeps coming back, the rest sits in the same screen, on the same measurements.
Who talks to whom, how much and when. Good for seeing what suddenly fills the line.
The map of the network as BlueEye found it. Delta shows what changed since last time: new devices, neighbours that are gone, ports that moved.
The route hop by hop, and which switch and port an address sits on. You know where to go.
Multi-step tests of the real user journey with timing per step. If the host answers but login fails, it says so.
The log per device in one place, so you can see what the device itself said when it went wrong.
Checks, log and topology gathered around the same device. No jumping between pages in the middle of an incident.
It all runs on your own server. The measurements and the map stay with you, tests included.
Service Assurance
The network can be green while the portal is down. BlueEye logs in to your web services at fixed intervals, clicks through the real user journey and speaks up when it breaks. Downtime on a citizen-facing service is something you have to document too.
BlueEye opens the page in a real browser, logs in, fills in the form and checks that what should be on screen is on screen. If the host answers a ping but login fails, we catch it.
BlueEye walks the portal itself and suggests the tests that make sense. You drag the steps into place with the mouse. No scripts, no developer.
An expired certificate is not a network problem. It is the thing that takes down self-service on a Sunday night. BlueEye reads the certificates on your services and warns 30 days ahead, and again 7 days ahead.
A service that is down all weekend becomes one incident carrying every observation. The alert goes out through the channels you already use, and is only sent again if things get worse.
When a test fails, it says what failed, which step it went wrong on, and shows a screenshot from that moment. Passwords are stored encrypted and masked, in the screenshot too. BlueEye only ever touches the addresses you have approved yourself.
Examples of use
Water utilities are the running example on this page, but BlueEye fits any organisation with scattered networks and NIS2 requirements. Some typical examples:
Water plants, treatment plants and pumping stations spread across a supply area.
Heating plants, transformer and metering stations with uptime requirements.
Factory halls and machine networks where downtime costs immediately.
Town halls, institutions and decentralised units across the municipality.
Hospitals and clinics with critical connections and stricter requirements.
Any organisation with multiple locations and NIS2 obligations.
Built for scattered infrastructure
Few organisations sit in one place. Remote units are spread across a large area, for instance water plants and pumping stations, production sites or branch offices. BlueEye gathers the monitoring of them all, no matter how many there are.
An honest boundary
BlueEye monitors the IT layer and the network connections between your sites. That is what we see, and what we stand behind.
What we cover
What we do not cover
We would rather say so up front than promise something we cannot measure.
Pricing
One agent equals one monitored unit. All prices are in Danish kroner excl. VAT. No lock-in, and you can scale up and down as you go.
Try it out
Steady operations
NIS2 + access control
Work out your own price
12 agents on Professional costs DKK 2,628 per month excl. VAT. No device licences on top, and the price only changes when the number of agents does.
Professional covers up to 25 agents.
Prices are per agent per month in Danish kroner excl. VAT.
Questions
If your question is not below, write to us in the form. We answer it ourselves.
On your own server. Measurements, flows and incidents stay with you and are not passed on to us or to anyone else.
Only the licence check, meaning how many agents are running. It may be offline for 14 days without anything stopping.
No. The server can run on a virtual machine you already have. An agent runs on a small machine per location, and devices without an agent can be polled over SNMP.
The analysis itself is robust statistics running locally (median and MAD z-score). A language model can be switched on if you want incidents written in prose. It is off by default and only ever sees masked summaries.
No. BlueEye writes a draft with timestamps, affected sites and measured cause. You read it through, correct it and submit it yourself.
The PLC and SCADA layer. We monitor the network between the sites, not the control of pumps and processes itself.
Nothing. 60 days with up to 5 agents. If it is not a fit, we stop again.
A day on most networks. The server is set up, the agents are installed per location, and then the measurements start coming in.
Yes. With Service Assurance you build tests of the actual user journey, login, form, receipt, and run them on a fixed schedule. The certificates on those services are watched at the same time. It is part of Professional.
BlueEye is built by people with 35 years of experience in Danish network infrastructure, backbone and hosting. We have run networks that must not go down, and we build BlueEye from that experience.
We do not sell over the phone. Call or write, and we will talk through your setup.
Tell us briefly about your setup and what you would like answered. We get back to you within a couple of business days.
No procurement process, no lock-in. We set up a pilot on your infrastructure, and you see for yourself what it catches. If it is not a fit, we stop again.
Book a pilot