Data Historian

Data historians, or historian, are systems used to collect and store data, including telemetry, events, alerts, and alarms about the operational process and supporting devices. The historian typically utilizes a database to store this data, and commonly provide tools and interfaces to support the analysis of the data. Data historians are often used to support various engineering or business analysis functions and therefore commonly needs access from the corporate network. Data historians often work in a hierarchical paradigm where lower/site level historians collect and store data which is then aggregated into a site/plant level historian. Therefore, data historians often have remote services that can be accessed externally from the ICS network. Many data historian vendors have designed their software to securely transfer data between the ICS and business networks instead of requiring business systems to access the data historian in the ICS network directly.

ID: A0006
ⓘ
Platforms: Embedded, Linux, Windows
Sectors: General
Version: 2.1
Created: 28 September 2023
Last Modified: 12 May 2026

Techniques

Domain ID Name
ICS T0830 Adversary-in-the-Middle
ICS T0878 Alarm Suppression
ICS T0802 Automated Collection
ICS T0895 Autorun Image
ICS T1695 Block Communications
.002 Ethernet
.003 Wi-Fi
ICS T0892 Change Credential
ICS T1701 Command and Scripting Interpreter
.001 PowerShell
.002 Windows Command Shell
.003 Unix Shell
.004 Visual Basic
.005 Python
.006 JavaScript
ICS T0885 Commonly Used Port
ICS T0884 Connection Proxy
ICS T0809 Data Destruction
ICS T0811 Data from Information Repositories
ICS T0893 Data from Local System
ICS T0814 Denial of Service
ICS T0816 Device Restart/Shutdown
ICS T0820 Exploitation for Evasion
ICS T0890 Exploitation for Privilege Escalation
ICS T0866 Exploitation of Remote Services
ICS T0822 External Remote Services
ICS T0823 Graphical User Interface
ICS T0874 Hooking
ICS T0872 Indicator Removal on Host
ICS T1694 Insecure Credentials
.001 Default Credentials
ICS T0849 Masquerading
ICS T0801 Monitor Process State
ICS T0834 Native API
ICS T0840 Network Connection Enumeration
ICS T0842 Network Sniffing
ICS T0861 Point & Tag Identification
ICS T0886 Remote Services
ICS T0846 Remote System Discovery
.001 Port Scan
.002 Broadcast Discovery
.003 Multicast Discovery
ICS T0888 Remote System Information Discovery
ICS T0847 Replication Through Removable Media
ICS T0848 Rogue Master
ICS T0851 Rootkit
ICS T0881 Service Stop
ICS T0869 Standard Application Layer Protocol
.001 DNS
.002 Publish/Subscribe Protocols
ICS T0862 Supply Chain Compromise
ICS T0894 System Binary Proxy Execution
ICS T0859 Valid Accounts