The present invention discloses a system and a method for analyzing and authenticating scenarios and actions that are taking place in a plant or a factory. Said analysis comprising the steps of: monitoring a plurality of data streams, originating from a plurality of independent sources within the plant. Said sources including at least part of production machines, machine sub-units, and independent indicators and sensors within the plant. •correlating between two or more monitored data streams, each relating to a specific action occurring within the plant, but originating from different data sources, or are of different data types; •analyzing said data stream correlations; and •obtaining specific characteristics that indicate the occurrence of specific actions within the plant.