← Unified IT/OT SOCFree interactive simulation · No sign-up · About 3 minutes

From suspicious engineering access to process disruption

At a fictional chemical factory, production is running normally when an engineer connects remotely to the control network. Follow the evidence as the session unfolds: is this routine maintenance, an operator mistake, or something more concerning?

Synthetic telemetry and simulated responses. Investigation follows a predefined scenario.

SimulationAgent-assisted · predefined investigation00:00 / 03:00
Step through or play the three-minute investigation0 updates · 2 retrieved records

Access path

0 / 7 observed
┄ Inventory━ Observed··· Inferred⊣ Containment
eng.user01identityREMOTE-01gatewayOT-FW01boundaryENG-WS01workstationPLC-01controller / criticalHMI-01hmiPROCESS-01process / criticalIT/OT boundaryMapped processeng.user01identityREMOTE-01gatewayOT-FW01boundaryENG-WS01workstationPLC-01controller / criticalHMI-01hmiPROCESS-01process / criticalIT/OT boundaryMapped process

Awaiting the first check

Partial evidence · connectivity alone does not establish a route

Relationships (6)

One IT/OT boundary. The engineering workstation is already inside OT. Inventory is context, not evidence of an attack.

Process pressure

PROCESS-01 / vessel pressure

200 kPa

Within threshold

Live synthetic telemetry · agent assessment uses separately retrieved records.

PLC-01
ControllerPROCESS-01
Pressure vesselHMI-01
Observation
Released synthetic pressure samples1 samples released. Within threshold. Threshold above 240 kPa for 20 seconds. A complete sample list follows.200240300Threshold 240 kPa00:0001:0002:0003:00
Samples & assessment (1)

Authored baseline 200 ± 5 kPa. A breach requires good samples above 240 kPa for 20s, with gaps ≤ 10s. This is fixture pacing, not a physical model.

Investigation activity

Deterministic

Evidence and investigation updates will appear here.

    Following latest activity.
    LowA case develops as evidence is checkedStart the investigation; the case opens once supporting records have been checked.
    About this demo

    Authored checks retrieve timestamp-bounded synthetic records. Decisions follow explicit conditions; no live model selects the steps. Graph observations and pressure calculations reuse the original replay. Live AI calls: 0.

    The chart shows synthetic telemetry as each sample becomes available. Graph findings, case evidence and severity use only records retrieved by the investigation. Viewing a sample does not mark it agent-reviewed. Baseline remains fixed. This demonstration establishes no autonomous-model qualification. Full bundled data is inspectable in developer tools, not confidential.

    Policy-assisted-1: High requires an accepted write, an explicit session link and an affirmative access concern. Critical additionally requires the critical mapped asset and good samples above 240 kPa for 20 seconds with gaps ≤ 10 seconds. These are authored scenario thresholds.