Dynatrace NAM (f.k.a. DCRUM) performs an in-depth network application protocol analysis, following transaction sequence that's specific to every application NAM monitors. This is the reason why we have decodes for the most important apps, from HTTP/HTTPS through SAP and Oracle Forms, to SQL databases and Citrix - each works in a different way and requires following the app logic packet-by-packet, analyzing their content, to understand where transition starts and ends, what's its name and user, and how are the errors signaled.
For a brief intro of the concept, have a look at https://university.dynatrace.com/elearning/dcrum/519/10839 at 11:40 to 20:40. It's not the news webcast, but principles remain the same.