OT command monitoring
Changes to the process are seen as they happen, with the command, the source and the target in the evidence.
- 01
Challenge
A write to a controller looks like any other packet to a firewall. Operators need to know when someone changes the process, not just that two devices talked.
- 02
What WireTrace sees
Decoded industrial operations: writes, parameter changes, mode changes, program transfers, forced I/O and firmware transfers.
- 03
What WireTrace understands
Which operations are normal for each controller, and which source is allowed to perform them.
- 04
What WireTrace decides
Unauthorised writes, program downloads, mode changes, rogue masters and illegal function codes raise alerts mapped to ATT&CK for ICS.
- 05
Integration / action
Alerts forwarded to the SIEM and notified to OT engineering by email or webhook.
- 06
Outcome
Changes to the process are seen as they happen, with the command, the source and the target in the evidence.
Condition: Command monitoring covers Modbus, S7comm, DNP3, IEC 60870-5-101/104, IEC 61850 MMS, Omron FINS, Mitsubishi SLMP/MELSEC and SEL Fast Message.
See it on your network.
A WireTrace evaluation runs on a mirror port, on your infrastructure, and shows your own devices, communications and risks.