  The Industrial Control System (ICS) environment encompasses a wide range of
intricate communication protocols, posing substantial challenges for Security
Operations Center (SOC) analysts tasked with monitoring, interpreting, and
addressing network activities and security incidents. Conventional monitoring
tools and techniques often struggle to provide a clear understanding of the
nature and intent of ICS-specific communications. To enhance comprehension, we
propose a software solution powered by a Large Language Model (LLM). This
solution currently focused on BACnet protocol, processes a packet file data and
extracts context by using a mapping database, and contemporary context
retrieval methods for Retrieval Augmented Generation (RAG). The processed
packet information, combined with the extracted context, serves as input to the
LLM, which generates a concise packet file summary for the user. The software
delivers a clear, coherent, and easily understandable summary of network
activities, enabling SOC analysts to better assess the current state of the
control system.
