Capture
The appliance receives the network traffic provided at the capture point. Which areas become visible depends on the selected connection.
TECHNOLOGY AND ARCHITECTURE
From network traffic
to a traceable finding.
AEGYS Pulse captures network traffic at an agreed capture point and analyses the observed communication. Here you can see how capture, processing, and analysis work together.
ARCHITECTURE
How the network view is created.
IT network
Workstation
Server
IT switch
Controlled segment boundary
Firewall
OT network
OT switch
PLC / Controller
Machine / Equipment
Traffic copy
SPAN / mirror port on the IT switch
AEGYS PULSE
Passive analysis
The appliance sits outside the regular traffic path.
Regular traffic path
Traffic copy for analysis
The capture point determines which traffic is visible. Additional network areas may require additional capture points.
Analyse
The captured information is examined for relevant communication patterns and anomalies.
Interpret
The results provide starting points for assessment by your team and for further investigation.
DETECTION METHODS
Which indicators the analysis brings together.
Signature matching
Checks the available data for known technical patterns.
Behavioural analysis
Examines communication patterns and changes that warrant closer review.
Threat intelligence
Compares observed characteristics with information about known malicious infrastructure or other threat indicators.
Which indicators can be derived depends on the available data and the analysis method used. An anomaly is assessed in the context of actual use.
DATA BASIS
Which data supports the analysis.
The assessment depends on which information is captured and which network area it covers. We agree the intended scope before deployment.
| Data type | Information included | Requirement / capture mode |
|---|---|---|
| Connection information | Source, destination, time, protocol, and data volume, where this information is available in the network traffic provided. | Passive provision of the relevant traffic through an agreed SPAN or mirror port or network TAP. |
Data protection, hardening, updates, and retention are covered under Security & operations .
INTEGRATION
Prepared for connection. Focused on the right area.
The appliance arrives prepared. Together with your IT team, we agree the capture point and the connection to the analysis platform.
For multiple sites or segmented networks, we discuss which areas should be included.
- Select the relevant network area.
- Provide a suitable SPAN or mirror port or network TAP.
- Agree the required connection to the platform.
ANALYSIS
Interpret observations transparently.
The analysis makes the underlying observations traceable. Your knowledge of systems and operational processes helps assess their significance and define next steps.
TECHNICAL QUESTIONS
What matters for the assessment.
NEXT STEP
How does the architecture fit your environment?
Let us discuss capture points, data scope, and integration into your existing processes.
Discuss technical integration