Secure · Threat Hunting & Retro-Hunt
Learn of a new threat today. Check last month’s traffic for it today.
When a new indicator arrives from your CERT, a vendor advisory or your own investigation, Synaptic OT runs it across recorded traffic. Matches become incidents for review, grouped by hour so the time of the attack is clear.
Why it matters
Measure dwell time, don’t guess it
Retro-hunt tells you whether an indicator was present before detection, and on which assets.
No slowdown on live monitoring
Hunts run under a separate, resource-limited database role, so live detection keeps its priority.
Grounded in real incidents
Hunt with the observables of 27 documented OT attacks, not a generic threat feed.
retro-hunt RH-0031 ioc src 10.0.0.55 · tcp/502 · fc in (5, 6, 15, 16) window 14 days of recorded traffic scanned 4.8 M packets matches 2 → INC-0409 (PLC-03), INC-0410 (PLC-05) pending review
Illustrative values
Capabilities
What's included
Threat Hunting & Retro-Hunt is part of the full Synaptic OT suite. One licence covers every capability on this site.
Time-travel retro-hunt
Streams across millions of indexed packets in pages, so even large hunts run within bounded memory.
Review before action
Every match is created as a pending-review incident. Nothing is escalated or blocked automatically.
Offline threat intelligence
Import IOC and STIX/TAXII bundles by secure package in air-gapped sites, or by allow-listed feed where outbound is permitted.
Campaign tracking
Related alerts across time and assets are grouped into campaigns that mirror multi-stage OT attacks.
ATT&CK for ICS mapping
Findings map to MITRE ATT&CK for ICS techniques for reporting and coverage planning.
IT-OT pivot hunting
Check SIEM-reported activity against authorised engineering workstations and maintenance windows.
Questions
Asked by OT and security teams
Does retro-hunt need the Wire DVR?
Yes. Retro-hunt searches the traffic the DVR has recorded and indexed, so how far back you can hunt depends on your recording policy.
Works with
See it on your own traffic.
Request an evaluation licence and run Synaptic OT on a mirror port or a PCAP from your plant. Fully offline if you need it to be.