| Time (s) | ID | Sender | DLC | Data | Meaning | Receiver verdict |
|---|
Sender is simulation ground truth, shown so you can learn. A real receiver never knows it; ECU_RX only sees the CAN id. Click a row to see how the frame was built and verified.
VSOC / SIEM connection
OffRequest preview and curl equivalent
Log content
DIDs are read at the moment of the event, exactly as UDS 0x22 would return them, and sent alongside the SecOC failure: a [diag@PEN] element in syslog (raw hex plus a decoded summary per DID, and the DTC status) and a diagnostics object in JSON. The heartbeat sends a SECOC_DIAG_SNAPSHOT with the full set even when nothing fails, so the VSOC sees healthy vehicles too. F20A is protected by SecurityAccess on UDS, so it stays out unless you include it.
Delivery
| Wall time | Events | Result | ms |
|---|---|---|---|
| Nothing sent yet. | |||
Each scenario builds a fresh network, runs its stimulus at full speed and checks the expected security behaviour. PASS means the attack was rejected and reported correctly. Load a result into the bench to inspect its trace and export it.
The full configuration of the live bench: ECU identities, CAN ids, Data IDs, keys, FV and MAC lengths, sync timing, DIDs, DTCs, IdsM thresholds and the syslog enterprise number. Numbers are decimal here (0x180 is 384). Apply rebuilds the live bench. Scenarios always use the default configuration because their checks expect it.