Monitor · Detect
Know every device, every write and every engineering change.
Passive monitoring that understands industrial protocols and your own engineering projects. Synaptic OT listens on a SPAN port or TAP and never sends a packet to a controller.
OT Network Monitoring & IDS
An IDS that reads Modbus the way your engineers do.
A write to holding register 40001 is a setpoint change, not a TCP payload. Synaptic OT decodes eight OT protocols passively and runs three deterministic detection layers, so an alert always comes with a reason you can check.
- Eight native dissectors. Modbus TCP, DNP3, OPC UA (wire and audit log), IEC 60870-5-104, Siemens S7comm, MQTT, BACnet/IP and EtherNet/IP, decoded down to function codes, objects and registers.
- Protocol anomaly layer. Learns a baseline per protocol, segment and asset, then flags new talkers, first-seen function codes or values, statistical outliers and off-hours activity.
- CyOTE correlation layer. Matches observables against 27 documented OT incidents from the Idaho National Laboratory CyOTE corpus: 6,076 observables mapped to 71 MITRE ATT&CK for ICS techniques.
- Protocol compliance layer. Flags specification violations such as reserved function codes, broadcast writes and unauthorised commands. Documented operational exceptions can be suppressed per asset.
protocol_anomaly HIGH
modbus/tcp fc=06 write_single_register
src 10.0.0.55 EWS-02 dst 10.0.0.107:502 PLC-07
register 40001 value 4000 baseline 3200–3450
reasons first_seen_value · off_hours (02:34) Asset Intelligence & Vulnerabilities
An asset register that notices when the plant changes.
Synaptic OT reconciles what it sees on the wire with what your engineering files and inventory say should be there. New, unknown and missing devices surface on their own, each with its vulnerabilities attached.
- Five-state asset lifecycle. Verified, shadow, under review, rogue and stale, with role-checked transitions and a full history of who changed what and why.
- Passive fingerprinting. Vendor, model, firmware, MAC and Purdue level inferred from traffic, with conflict detection when sources disagree.
- CVE correlation. Matched against 12,022 CVEs from 3,854 CISA CSAF advisories, shipped offline and updatable by secure package.
- Vulnerability SLA tracking. Due dates and breaches per asset and per team, visible to managers and executives.
PLC-07 verified Rockwell 1756-L83E fw 33.011 L1 EWS-02 verified Windows 10 LTSC L2 10.0.4.19 shadow first seen 02:11 no project match HMI-03 stale last traffic 41 days ago
Project Files, Baselines & Drift
Compare what the plant was designed to do with what it is doing.
Upload the project files your engineers already export. Synaptic OT builds an engineering baseline, then watches live traffic for connections, tag writes and program downloads the design never allowed.
- Ten project-file formats. Rockwell L5X and ACD, Schneider XEF and ZEF, PLCopen XML (Siemens TIA, CODESYS, Omron, EcoStruxure), IEC 61850 SCD, PROFINET GSDML, EtherNet/IP EDS, AutomationML and CSV tag databases.
- Honest fidelity stamp. Every ingested file is marked full fidelity or best-effort forensic, so you always know how complete the parsed model is.
- Versioned baselines. Each upload becomes a version. Compare any two, review the deltas by risk class, then approve the change or keep the old baseline active.
- Program-download integrity. Blessed project files are stored content-addressed. Downloads seen on the wire are matched against them and diffed block by block (L5X, L5K, S7P, TIA archive or hex).
project Line3_Packaging.L5X v2 vs v1 (active baseline) + tag write EStop_Interlock SAFETY_TAG_WRITE TIER_1 + connection IT-VLAN → PLC-07 UNAUTHORIZED_PATH TIER_2 - connection PLC-07 → Historian config drift TIER_4 decision pending engineering approval
See it on your own traffic.
Request an evaluation licence and run Synaptic OT on a mirror port or a PCAP from your plant. Fully offline if you need it to be.