Monitor · Project Files, Baselines & Drift
Compare what the plant was designed to do with what it is doing.
Upload the project files your engineers already export. Synaptic OT builds an engineering baseline, then watches live traffic for connections, tag writes and program downloads the design never allowed.
Why it matters
Catch unauthorised program changes
An in-flight program download is checked against the baseline you approved. A changed logic block is shown as a line-by-line diff, not a hash mismatch.
Alerts in your engineers’ language
Registers resolve to tag names from your project, so an alert reads "write to EStop_Interlock" instead of "write to 40017".
Drift that a passive monitor cannot see
When the project says a connection should not exist and live traffic shows it does, Synaptic OT raises one fused alert with both pieces of evidence.
project Line3_Packaging.L5X v2 vs v1 (active baseline) + tag write EStop_Interlock SAFETY_TAG_WRITE TIER_1 + connection IT-VLAN → PLC-07 UNAUTHORIZED_PATH TIER_2 - connection PLC-07 → Historian config drift TIER_4 decision pending engineering approval
Illustrative values
Capabilities
What's included
Project Files, Baselines & Drift is part of the full Synaptic OT suite. One licence covers every capability on this site.
Ten project-file formats
Rockwell L5X and ACD, Schneider XEF and ZEF, PLCopen XML (Siemens TIA, CODESYS, Omron, EcoStruxure), IEC 61850 SCD, PROFINET GSDML, EtherNet/IP EDS, AutomationML and CSV tag databases.
Honest fidelity stamp
Every ingested file is marked full fidelity or best-effort forensic, so you always know how complete the parsed model is.
Versioned baselines
Each upload becomes a version. Compare any two, review the deltas by risk class, then approve the change or keep the old baseline active.
Program-download integrity
Blessed project files are stored content-addressed. Downloads seen on the wire are matched against them and diffed block by block (L5X, L5K, S7P, TIA archive or hex).
Config-drift detection
Safety-tag writes, unauthorised communication paths and read-only violations are classified by intent and fused with live-traffic alerts on the same asset.
Watched-folder ingest
Point Synaptic OT at an export folder and new project versions are picked up automatically. Files are analysed on the appliance in every deployment tier.
Questions
Asked by OT and security teams
Do project files leave our site?
No. Project files are treated as more sensitive than live traffic and are always analysed locally, even in deployments where some outbound traffic is allowed.
Do you connect to TIA Portal or Studio 5000?
No. Synaptic OT reads the open export formats your engineers already produce. It never connects to engineering software or controllers.
Works with
See it on your own traffic.
Request an evaluation licence and run Synaptic OT on a mirror port or a PCAP from your plant. Fully offline if you need it to be.