Protect · Human-Approved Response
From alert to firewall rule in minutes. Applied by your team, never by a script.
Automated actions are dangerous in a running plant. Synaptic OT prepares the response for you, with the blast radius and the exact rule text, and stops at the point where a person has to decide.
Why it matters
Safe by design
No playbook step and no remediation card executes without approval. Firewall rules are exported for your team to apply. Nothing is pushed.
Engineers and analysts on the same page
An OT action card turns the SOC finding into a five-question checklist an on-call engineer can answer in a minute.
Fewer false alarms from planned work
Maintenance windows and authorised engineering workstations lower the confidence of alerts caused by approved work.
# FortiOS · RC-118 · approved by shift manager 03:06
config firewall policy
edit 0
set name "syn-INC-0412-block-ews"
set srcaddr "EWS-02" set dstaddr "PLC-03" "PLC-05" "PLC-07"
set service "MODBUS-TCP-502" set action deny
next
end Illustrative values
Capabilities
What's included
Human-Approved Response is part of the full Synaptic OT suite. One licence covers every capability on this site.
Playbooks with approval gates
Incidents match playbooks automatically. Each step that changes anything waits in a manager’s approval queue with the blast radius shown.
Remediation cards
What to do, why, the risk tier and blast radius, and the exact configuration snippet for your vendor.
Firewall rule export
FortiOS, Cisco ASA and PAN-OS syntax, plus CSV for any other firewall.
OT action card
Packet details, maintenance context and the OT Response Checklist in Markdown, ready to paste into a ticket or chat.
Maintenance windows
Register planned work and authorised engineering laptops. Matching alerts are scored and explained, not hidden.
Containment webhooks
Send an approved containment action to your own tooling, with typed confirmation and an outbound allow-list.
Questions
Asked by OT and security teams
Can Synaptic OT push rules to our firewalls?
No, by design. It produces the rule text for your team to review and apply. This keeps change control in your hands.
Which ticketing tools are supported?
ServiceNow today, plus email and Slack notifications. Generic webhooks reach other tools.
Works with
See it on your own traffic.
Request an evaluation licence and run Synaptic OT on a mirror port or a PCAP from your plant. Fully offline if you need it to be.