Industrial Protection and Evidence

L2Proxy combines the decision path and the evidence path. The same traffic can be decoded, evaluated against stateless or stateful policy, recorded or enforced, translated into industrial language, and retained for investigation.

Figure — Protection and evidence start from stateful, industrial-aware enforcement—not packet-only filtering.

Purpose and expected outcome

This section explains what L2Proxy detects and protects, how decisions are made, and how the resulting activity is presented and retained. After reading it, the customer should understand the chain from protocol facts to policy outcome and operational evidence.

One traceable chain

L2Proxy Dissector
        ↓
Equipment, identity, and protocol context
        ↓
Stateless or stateful Rule Engine decision
        ↓
Record / Allow / Block
        ↓
Industrial description, classification, and tags
        ↓
Live view, archive, reporting, and investigation

Two capability groups

Group	Customer question answered
Detection and Protection	Is the operation permitted, correctly sequenced, and consistent with the approved industrial context?
Visibility and Evidence	What happened, what did it mean to the plant, and what detailed evidence supports that conclusion?

Start with Industrial Detection and Protection or From Industrial Traffic to Operational Evidence.