WIRETRACEDeep Protocol & Asset Intelligence

WireTrace Technical Overview

How WireTrace works, what it supports and how it fits your network

The architecture, deployment models, protocol coverage, analytics scope, data handling and platform security of WireTrace, stated precisely enough to design, review and procure against.

For: Security architects, network and OT engineers, procurement and technical evaluators

WireTrace is a Deep Protocol & Asset Intelligence (DPAI) platform. Sensors receive a mirrored copy of network traffic, decode it to the level of individual protocol fields, and a central platform turns that evidence into durable device identity, classification, detection, risk and policy decisions across IT, OT, IoT and medical devices (IoMT). This document describes how it is built, how it is deployed and what it does and does not do.

01Platform flow

Every WireTrace capability sits on one chain of evidence, shown on the cover. Each layer consumes what the layer before it produced, so the identity that names a device in the inventory is the same identity that scopes a detection, ranks a vulnerability and travels with an alert into your SIEM.

02Reference architecture

A WireTrace deployment has four parts: sensors at the points where traffic is mirrored, a central platform on a server or virtual machine you own, an integration layer towards the tools you already run, and two optional paths that are off until you configure them: active enrichment and, for air-gapped sites, an offline data path.

Sensors

A sensor has two network roles. The capture interface receives mirrored traffic and decodes it; it has no transmit path. The management interface carries the sensor's results to the central platform. Sensors are enrolled with an activation token, and sources that are not enrolled are refused. The platform includes a built-in sensor; additional sensors are sized to the link, from small appliances to high-throughput servers.

Central platform

The platform installs on customer-owned servers or virtual machines from one self-contained package, and its resources are sized from the host automatically. It holds the inventory, analytics, baselines, policies, console, reports, REST API and Rumi, the private AI assistant, and builds one de-duplicated inventory across all sensors.

Integration layer and optional paths

Outbound, the platform forwards alerts and decisions to your tools and exposes a read-only REST API that is off until enabled; inbound, it accepts sign-in, device syslog and SNMP traps, indicator files and read-only switch data (section 09). Active enrichment adds read-only switch and router polling and credentialed collection from hosts an administrator chooses. The offline data path refreshes threat indicators and vulnerability data on air-gapped sites: a collection script runs on any internet-connected machine, and its checksummed bundle is carried across under your own transfer process and imported in the console. The appliance never connects out.

03Capture options

WireTrace builds the asset inventory from mirrored traffic. Discovery is only as complete as the traffic the sensors see, so placement matters more than any other deployment decision.

Good placement points are the boundaries where devices actually communicate: between Purdue levels, at the industrial DMZ, at core and distribution switches carrying east-west traffic, and on links to remote sites. Devices behind routers appear by address unless their own traffic is seen or enrichment adds detail.

04Deployment models

05Protocol coverage

WireTrace decodes 250+ protocols. It decodes payloads, not just headers: it extracts identity and operational fields such as vendor, order number, firmware, station and host names and certificate details, and records which observed evidence produced each attribute. Many industrial, building and network protocols carry the device's own identity record, and WireTrace uses it as primary evidence. Representative protocols by family:

Operation semantics. For industrial protocols WireTrace understands what a conversation does (reads, writes, program transfers, mode changes, exceptions), not just that two devices talked. OT command monitoring, which raises detections on those operations, covers Modbus, S7comm, DNP3, IEC 60870-5-101/104, IEC 61850 MMS, Omron FINS, Mitsubishi SLMP/MELSEC and SEL Fast Message. Other industrial protocols, including EtherNet/IP, PROFINET, OPC UA, BACnet and S7CommPlus, contribute identity and discovery.

Encrypted traffic. WireTrace does not decrypt traffic. TLS client fingerprints and certificate details are recorded for identity, hygiene and threat matching, and encrypted sessions still yield behavioural evidence. Encrypted industrial payloads are not analysed in depth.

06Identity and classification method

1. Collect evidence, not guesses. Identity combines many independent kinds of evidence. An IP address locates a device but never identifies it, and directory and authentication names corroborate a host but never identify it alone.
2. Join on what is unique. Evidence is joined only on values a device states uniquely. When two devices present the same supposedly unique value (a cloned image, a vendor default, a relaying gateway), WireTrace refuses to merge them blindly and records the contradiction.
3. Track time. Identity evidence is time-bounded: first seen, last seen and still valid. Address changes are tracked as transitions, not conflicts, and stale bindings expire safely.
4. Classify with stated confidence. 600+ built-in classification rules and a hierarchical device taxonomy assign domain, type, role and Purdue level. Devices without enough evidence stay unknown rather than guessed. Administrators can add their own rules in a no-code editor, with a preview before anything is applied.
5. Explain. Every identity carries an evidence-weighted confidence, and every value shows its source and freshness. The full grade and explanation are available through the API. For each device, WireTrace also states which kinds of evidence are present, missing or stale, so an empty result is never presented as a clean one.

Manufacturer is normalised to one name, with a labelled low-confidence fallback to the network-card maker. Operating system is inferred passively with a stated confidence, and credentialed collection adds the exact version. 150+ cloud, SaaS, vendor-cloud and infrastructure applications are recognised, and you can add your own.

07Detection and analytics scope

All detection is deterministic and states the evidence it rests on. The table states the scope of each area and the condition, where one applies.

Baselines, segmentation and policy

A Communication Baseline records a window of observed traffic; operators review the communication pairs found and approve, monitor or deny each one. A Protocol Behaviour Baseline learns which fields and values each industrial protocol normally carries, and once approved, a new field or value such as a previously unseen function code raises a deviation. Deviation checks run on a schedule you attach.

Segmentation intent is declared as traffic rules and as IEC 62443 zones, conduits and target security levels. WireTrace continuously detects traffic that breaks that intent, including IT-to-OT conduit crossings and large Purdue-level jumps. Policies define what happens when conditions become true, and each runs as monitor only, recommend, require approval or automatic, with four-eyes approvals that expire, an emergency stop, change freezes, maintenance windows and a maximum number of assets per action. WireTrace provides the intelligence, intent and validation; your existing firewalls, NAC and switches enforce it.

08Data handling

09Integrations summary

The WireTrace Integrations Overview describes each integration by direction and purpose.

10Platform security

• Trusted sensors only: sensors are enrolled with an activation token, and sources that are not enrolled are refused.
• Sign-in and roles: LDAP/Active Directory, OpenID Connect single sign-on or an email one-time passcode; role-based access control governs what each user can see and do.
• Accountable change: every decision and action, administrative or automated, is recorded in an append-only activity log. Changes WireTrace makes can be time-bound and undone with a preview.
• Controlled data exits: the REST API is read-only and off until enabled, with scoped tokens, rate limits and IP allowlists. Audit evidence leaves as a signed evidence bundle.

Every content change is tested, peer-reviewed and versioned before release, and the Platform Updates page shows each intelligence area with its version and freshness.

11Specification