Device Alarm

This includes alarms associated with unexpected device functions, such as shutdowns, restarts, failures, or configuration changes

ID: DC0108
Domains: ICS
Version: 2.0
Created: 11 May 2022
Last Modified: 13 October 2026

Log Sources

Name Channel
alarmserver:ApplicationLog alarm suppression Application Programming Interface (API) call logged without operator session identifier (ID)
alarmserver:ApplicationLog alarm class disabled or suppressed Application Programming Interface (API) event logged without operator_id field populated
device:VendorLog measured scan cycle time or interrupt response latency deviates from baseline cycle time by more than cycle timing deviation threshold following a task configuration change
device:VendorLog measurable change in scan cycle timing or Input/Output (I/O) update pattern following a flagged program write
Operational Databases None
operationaldb:AlarmEvent device reboot/restart alarm within firmware update window of the flagged transfer session
operationaldb:AlarmEvent device reboot within firmware update window of the flagged transfer session
operationaldb:AlarmEvent device receives commands from two distinct master identities within a short window
operationaldb:AlarmEvent device_ip transitions to PROGRAM/STOP mode without operator_ack and without corresponding open change ticket reference
operationaldb:AlarmEvent device mode-change alarm generated without corresponding operator_id entry within mode change ack window
operationaldb:AlarmEvent alarm threshold configuration changed without operator_ack or change ticket reference
operationaldb:AlarmEvent more than one device generates restart/offline alarm within bulk restart time window without open maintenance ticket
operationaldb:AlarmEvent device_ip alarm telemetry goes silent within alarm silence grace period of the mode-activation message without operator acknowledgment
operationaldb:AlarmEvent device offline alarm coinciding with switch port admin-down syslog for that port
processsensor:RedundantComparison device-reported value for a tag diverges from independently measured value for same physical quantity by more than sensor tolerance threshold

Detection Strategy