This includes any data stores that maintain historical or real-time events and telemetry recorded from various sensors or devices
| Name | Channel |
|---|---|
| Databases | None |
| Operational Databases | None |
| operationaldb:ProcessHistory | no new process value recorded for device_ip within 1.5x expected poll interval immediately following a flood alert |
| operationaldb:ProcessHistory | process value crosses known alarm threshold but no corresponding alarm event recorded within expected latency window |
| operationaldb:ProcessHistory | multiple safety-critical outputs toggle within rapid toggle window, pattern consistent with scripted issuance |
| operationaldb:ProcessHistory | I/O point value oscillates or changes state at frequency exceeding max normal state change rate, inconsistent with physical process response time |
| operationaldb:ProcessHistory | reported values show statistically improbable stability during a period when physical process is known to be actively changing |
| operationaldb:ProcessHistory | tag value deviates from rolling baseline mean by more than parameter drift threshold percent within time window following a flagged write |
| operationaldb:ProcessHistory | process value expected to change following a command does not change within command confirmation window |
| operationaldb:ProcessHistory | no unsolicited report received from device_ip within 1.5x expected reporting interval, while direct polling confirms device is reachable |
| processsensor:RedundantComparison | Independent process measurement comparison: controller I/O image value diverges from independent sensor/measurement beyond configured integrity tolerance |