From Industrial Traffic to Operational Evidence

L2Proxy turns high-volume protocol traffic into evidence that operations, engineering, and OT security can understand and use. It retains the technical facts needed for investigation while presenting the event in the language of the plant.

Purpose and expected outcome

This section explains how traffic becomes operational evidence. After reading it, the customer should understand the relationship between decoded protocol facts, authenticated session context, policy decisions, normalized industrial events, live views, historical investigation, and retention.

Industrial message
        ↓
Protocol dissection
        ↓
Authenticated user and session context (L2Proxy Connect)
        ↓
Policy decision
        ↓
Equipment and point context
        ↓
Industrial description, classification, and tags
        ↓
Live view, archive, investigation, and reporting

Four complementary evidence levels

Evidence level	Primary audience	Question answered
Protocol dissection	Protocol and control engineers	What exactly was present in the message?
Access-session context	Operations, access administrators, and OT security	Which authenticated user and live session carried the activity?
Rule decision	Operations, engineering, and OT security	Which policy matched and was the operation accepted or blocked?
Normalized industrial event	Control room, asset owner, reporting, and investigation	Which asset and operation were involved, how important was it, and what happened?

Figure — Industrial evidence pipeline: from traffic and sessions to normalized, searchable evidence.

The levels are linked rather than substituted. A concise industrial event can still lead to the original detailed evidence when deeper analysis is required.

Industrial-language events

A protocol code and point number can be presented as an event such as:

SCADA Master issued a Close request to the F12 feeder breaker. The command was blocked because the breaker was not available for approved remote operation.

The record can carry equipment, point, operation, direction, category, severity, criticality, alarm state, policy result, and discovery tags while retaining the original protocol facts.

Live and historical use

• Observe current dissections and policy decisions.
• Filter by event family, protocol, verdict, asset, operation, or tag.
• Follow activity for an authenticated user or individual access session when L2Proxy Connect is used.
• Open detailed frame evidence when required.
• Retain raw and normalized records for later investigation.
• Identify unknown devices and points for engineering follow-up.
• Build reports around industrial activity rather than packet volume alone.

Customer value

• Faster recognition of consequential industrial activity
• Fewer unexplained protocol-only alerts
• Shared evidence for operations, engineering, and security
• Traceability from a normalized statement to original message detail
• Searchable history of accepted and blocked commands
• Direct user-to-session-to-operation traceability for identity-aware access
• Better commissioning and asset-discovery evidence

Continue with Industrial Event Normalization or Session Operations and Evidence.