A method includes holding multiple primitives of a communication protocol, which is used for managing a controller that controls one or more field devices in an industrial control network. Multiple scenarios are defined, each corresponding to one or more respective sequences of primitives exchanged with the controller over the industrial control network for achieving a respective user-level operation. Multiple parsing rules for deriving the sequences of primitives from the respective scenarios are further defined. A sequence of primitives that were exchanged with the controller over the industrial control network is intercepted. An attempt to reconstruct from the intercepted sequence of primitives, using the parsing rules, one or more scenarios that each corresponds to the intercepted sequence of primitives is carried out, and, in response to succeeding in reconstructing one or more scenarios, extracting user-level information from the reconstructed scenarios.