A method, comprising: receiving, by a device, a plurality of communication messages, wherein the plurality of communication messages is communicated between a plurality of operational technology devices across a plurality of OT control layers of an OT environment; causing, by the device, the plurality of communication messages to be stored in a first data structure; identifying, by the device, a set of communication messages stored in the first data structure; determining, by the device, whether each communication message, of the set of communication messages, is a request message or a response message; identifying, by the device and based on determining whether each communication message is a request message or a response message, at least one communication message pair, wherein a communication message pair comprises a request message and a response message that is a response to the request message; generating, by the device and based on determining the at least one communication message pair, one or more communication entries, wherein a communication entry, of the one or more communication entries, includes respective message header information of a request message and a response message that comprise a communication message pair, and wherein the communication entry further includes one or more of communication statuses associated with the request message and the response message, and: wherein the one or more communication statuses include: a matched status or an unmatched status, a time delay status, a warning or errors status, or a length status; causing, by the device, the one or more communication entries to be stored in a second data structure; and causing, by the device and based on the one or more communication entries, one or more actions to be performed. receiving, by a device, a plurality of communication messages, wherein the plurality of communication messages is communicated between a plurality of operational technology devices across a plurality of OT control layers of an OT environment; causing, by the device, the plurality of communication messages to be stored in a first data structure; identifying, by the device, a set of communication messages stored in the first data structure; determining, by the device, whether each communication message, of the set of communication messages, is a request message or a response message; identifying, by the device and based on determining whether each communication message is a request message or a response message, at least one communication message pair, wherein a communication message pair comprises a request message and a response message that is a response to the request message; generating, by the device and based on determining the at least one communication message pair, one or more communication entries, wherein a communication entry, of the one or more communication entries, includes respective message header information of a request message and a response message that comprise a communication message pair, and wherein the communication entry further includes one or more of communication statuses associated with the request message and the response message, and: wherein the one or more communication statuses include: a matched status or an unmatched status, a time delay status, a warning or errors status, or a length status; wherein a communication entry, of the one or more communication entries, includes respective message header information of a request message and a response message that comprise a communication message pair, and wherein the communication entry further includes one or more of communication statuses associated with the request message and the response message, and: wherein the one or more communication statuses include: a matched status or an unmatched status, a time delay status, a warning or errors status, or a length status; a matched status or an unmatched status, a time delay status, a warning or errors status, or a length status; causing, by the device, the one or more communication entries to be stored in a second data structure; and causing, by the device and based on the one or more communication entries, one or more actions to be performed.