This includes sources of current and expected devices on the network, including the manufacturer, model, and necessary identifiers (e.g., IP and hardware addresses)
| Name | Channel |
|---|---|
| Asset | None |
| assetinventory:MasterAddress | command traffic uses master/station address not in registered master addresses |
| assetinventory:ProgramHash | post-transfer program hash does not match last authorized program baseline |
| assetinventory:ProgramSize | device program size/block count increases without corresponding change ticket reference |
| ID | Name | Technique Detected |
|---|---|---|
| DET0914 | Detection of Program Append | T0843.003 |
| DET0752 | Detection of Program Download | T0843 |
| DET0792 | Detection of Rogue Master | T0848 |