Secure · Wire DVR & Forensics
Rewind the plant network to the second it mattered.
Synaptic OT records OT traffic continuously, the way a DVR records a camera. When an incident opens, the minutes around it are locked, indexed and ready to replay, then sealed into evidence anyone can verify offline.
Why it matters
The packets are already there
No more "we weren’t capturing at the time". Each incident locks the traffic before and after it, and follows earlier talkers back in time.
Replay instead of reconstruct
Step through recorded OT events over any time window, or upload a PCAP and run it through the full detection pipeline.
Evidence that stands on its own
Evidence packs carry an Ed25519-signed manifest, per-file SHA-256 hashes and a Merkle root. An auditor or insurer can verify them without contacting us.
evidence-pack/INC-0412
├─ INDEX.json sha-256 per file
├─ pcap/ 02:31:40 – 02:37:10 (sanitised: vendor)
├─ decode.json timeline.json
├─ manifest.json merkle root 9f2c…41ab
└─ manifest.sig Ed25519 · verifies offline Illustrative values
Capabilities
What's included
Wire DVR & Forensics is part of the full Synaptic OT suite. One licence covers every capability on this site.
Rolling capture per sensor
Continuous recording with health monitoring for gaps, packet drops, zero-traffic periods and unclean shutdowns, so you know how complete a recording is.
Incident-locked clips
A configurable window around every incident is protected from rotation, with a back-chain that follows earlier conversations from the same hosts.
Per-packet index
Every recorded packet is indexed by address, port, protocol and OT fields such as Modbus unit, function code and value, so searches take seconds.
State replay
Replay recorded OT events across any window on a timeline, with protocol decode and process values.
Vendor-safe sharing
Sanitisation presets scramble addresses (prefix-preserving) and neutralise MACs before a pack goes to an equipment vendor or outside responder.
Trusted time and hardware keys
Packs can carry RFC 3161 timestamps on connected tiers, and evidence keys can be sealed in a TPM where available.
Questions
Asked by OT and security teams
How long is traffic kept?
You set the recording policy per sensor. Incident clips are locked for as long as the incident record is retained. Connected deployments can move older recordings to your own S3-compatible storage.
Is a recording admissible as evidence?
Synaptic OT gives you tamper-evident, signed packs with documented integrity checks. Whether they are admissible is a question for your legal counsel and jurisdiction.
Works with
See it on your own traffic.
Request an evaluation licence and run Synaptic OT on a mirror port or a PCAP from your plant. Fully offline if you need it to be.