Skip to content

Commissioning and Investigation

L2Proxy supports policy engineering before production blocking and evidence-driven analysis after an event. The same protocol decoder, Rule Engine, Policy Profile, and normalization model can be used across passive, offline, and inline work.

Passive commissioning

Use passive observation to establish:

Industrial evidence pipeline stages from traffic to searchable evidence

Figure — Evidence pipeline used during passive commissioning and investigation.

  • known devices, endpoints, and industrial protocols;
  • normal measurements, states, commands, and sequences;
  • maintenance, startup, recovery, and failover behavior;
  • unknown devices and point mappings requiring engineering review;
  • candidate violations and expected exceptions;
  • event volume and archive requirements.

Candidate protections initially record deviations without interrupting production.

Offline validation

Recorded industrial traffic can be evaluated with a candidate Policy Profile to verify:

  • expected operations match the intended policy;
  • invalid values and commands produce the intended decision;
  • stateful sequences handle timeout, replay, duplicates, and missing steps;
  • normalized events contain useful asset and operation context;
  • changes do not regress previously approved cases.

This supports FAT, SAT, training, regression testing, and change-window preparation.

Incident investigation

The investigation path brings together:

  1. normalized industrial events for fast operational understanding;
  2. rule decisions showing the policy and verdict;
  3. state transitions and timeout events where sequence matters;
  4. original protocol dissections for engineering detail;
  5. service-specific logs for operating diagnosis;
  6. archive queries for event history and correlation.

Transition to enforcement

Once equipment mappings, operating assumptions, and policy outcomes have been approved, the Policy Profile is assigned to an inline Service Profile. The independent service can be activated under change control while passive or offline services continue their own work without interruption.

Customer value

  • Reduce policy changes based on assumptions alone.
  • Use the same decision logic from test through production.
  • Preserve evidence for engineering approval and rollback.
  • Shorten the path from an operator-readable event to detailed technical proof.
  • Keep commissioning and investigation isolated from established enforcement services.