AEObservability · Access control
Observability for Nedap AEOS
Doors, controllers and access logs as security data, in your SOC, next to your IT identities.
Blis Observability for AEOS brings access events, door alarms and controller health from Nedap AEOS into Elastic, read-only, so your security team sees what facilities sees, and audit evidence is one dashboard away.
Read-only · Works with your partner · Elastic Select Partner
Which doors are silently offline right now, and could you prove your access logs for the audit?
Is this you?
Three things we hear about access control
- 01
“A controller went offline last week. Nobody noticed.”
A door that silently stops reporting is a security gap, until someone happens to walk past.
- 02
“Door alarms stay in the AEOS client.”
Forced and held-open doors are seen locally, if at all, and not by the team that handles security incidents.
- 03
“The auditor asks for access logs, again.”
Retaining and presenting access evidence takes days of manual work.
What you get
Detections and dashboards
Controller or door offline
Treated as a security event, with an alert.
Forced or held-open door
Door alarms in your SOC, with site, zone and time.
Off-hours access
Badges used outside business hours in sensitive zones such as server and control rooms.
Disabled or expired badges
Use of a badge that should no longer work.
Access-right changes
Changes to authorisations for sensitive zones.
Impossible travel
A badge at the door and a network sign-in from elsewhere, minutes apart.
Dashboards
Door and controller availability
Access activity per site and zone
Alarms
Security detections
Compliance evidence
AEOS platform health
- Runbooksfor every alert
- Monthly reportin the Run service
- Rulesdelivered as Elastic Security detection rules
Physical meets digital
Same person. Two places. Two minutes apart.
Facilities sees a badge at the Rotterdam office at 09:02. IT security sees a VPN sign-in from abroad at 09:04. Separately, both look fine. In one Elastic timeline, it is one incident. Blis Observability for AEOS puts access events next to your Entra ID, Active Directory and VPN sign-ins, so physical and digital identity finally meet.
How it works
From door to SOC
- 01 · Source
Nedap AEOS
Doors, controllers and the AEOS server
in your network - 02 · Collect
Blis collector
Reads the AEOS web service with a read-only user. Also collects AEOS server and database health.
in your network - 03 · Store
Elastic, yours
Your existing Elastic, a customer-owned EU deployment, or on-premise.
- 04 · Outputs
- Detections
- Dashboards
- Evidence
- Correlation with IT identities
- 05 · Where it lands
- Your SOC
- Microsoft Teams
- Your service desk
Read-only.
We read through the AEOS web service with a read-only user. We never write to AEOS or its database.
Inside your network.
The collector runs next to AEOS. AEOS is never exposed to the internet.
Your Elastic.
In the Elastic you already run, a customer-owned deployment in the EU, or on-premise if access data must stay on site.
What is included
- Access events and door alarms in ElasticIncluded
- Door and controller availabilityIncluded
- Six dashboards and ready-made detection rulesIncluded
- AEOS server and database healthIncluded
- Runbooks, data-flow description, input for your DPIA and works councilIncluded
- Training and handoverIncluded
Works with your partner
Your partner stays your partner.
Your Nedap partner maintains AEOS and your doors, and that does not change. We need one session with them to activate the AEOS web service and create a read-only user. After that, we keep them informed of anything we see that needs their hands. Partners who want to offer this to their own customers: talk to us.
For partners →Privacy and works council
Security monitoring with a defined purpose.
Access data is personal data. We use it for security and compliance only, never for attendance or performance. Person references are pseudonymised in dashboards by default, and only authorised security roles can see who was involved in an incident. You receive a plain-language description of purpose, data, access and retention for your DPIA and, in the Netherlands, your works council.
How to start
Scan, assess, implement, run
- 0
Scan
free · 1 hourYour AEOS version, sites and doors, your SOC, your regulatory scope. A short findings note.
- 1
Assess
fixed price · about two weeksA baseline on your own AEOS data: controller and door health, alarm patterns, off-hours access in sensitive zones, and the gaps in your access evidence.
- 2
Implement
fixed price per sizeThe collector, dashboards, detections and identity correlation, set up with your partner and accepted against agreed criteria.
- 3
Run
monthlyWe keep the pack current with every AEOS and Elastic release, tune the rules and send a monthly report. Your SOC or MSSP handles 24/7 response.
Why Blis Digital
Physical and digital security in one view
- 01
Built for AEOS
A pack designed around the AEOS web service, for security and facilities teams.
- 02
Physical and digital security in one view
Access events next to your IT identities and sign-ins.
- 03
Read-only and partner-friendly
One session with your partner, and no writes to AEOS.
- 04
In your own Elastic
EU or on-premise.
- 05
Elastic Select Partner
Blis Digital is an Elastic Select Partner.
FAQ
Questions we get asked
A pack on Elastic that brings Nedap AEOS access events, door alarms and controller health into your SOC, with detection rules, dashboards, evidence and correlation with your IT identities.
No. We read through the AEOS web service with a read-only user and never write to AEOS or its database.
Activation of the AEOS web service licence and a read-only technical user. We plan this with them in one session.
Versions with the AEOS web service. We confirm your version during the free scan.
It runs on Elastic: your existing deployment, a customer-owned Elastic Cloud deployment in the EU, or on-premise.
It is security monitoring with a defined purpose. Person references are pseudonymised by default, and we provide the description you need for your DPIA and works council.
Yes. Detections are delivered as Elastic Security rules and cases can go to your SOC, your MSSP or your service desk.
This pack is built for Nedap AEOS. Tell us what you run, and the approach can extend to other platforms.
Free scan