Process/Event Alarm

This includes a list of any process alarms or alerts produced to indicate unusual or concerning activity within the operational process (e.g., increased temperature/pressure)

ID: DC0109
Domains: ICS
Version: 2.1
Created: 11 May 2022
Last Modified: 13 October 2026

Log Sources

Name Channel
Databases None
Operational Databases None
operationaldb:AlarmEvent communication-loss alarm for affected devices within comm block correlation window of the flagged configuration change
operationaldb:AlarmEvent alarm status transitions to suppressed/shelved/disabled/acknowledged without matching operator_id entry within suppress grace period
operationaldb:AlarmEvent process state change recorded without preceding operator_ack or scheduled switching order reference
operationaldb:AlarmEvent device_ip communication-loss alarm within serial block correlation window of a flagged serial gateway configuration change
operationaldb:AlarmEvent expected communication absent for device_ip without corresponding device-generated alarm explaining the gap

Detection Strategy