Real-time network monitoring identifies a source issuing read-only Industrial Control System (ICS) protocol requests to multiple field devices at a polling rate exceeding the legitimate Supervisory Control and Data Acquisition (SCADA) baseline, from a source not in the approved control server allowlist. Because the action is read-only, source-identity and rate deviation are the only available distinguishing signals. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | opc:applog | client_id not in approved Open Platform Communications (OPC) clients issuing high-volume read requests |
| Network Traffic Content (DC0085) | NSM:Content | read-only function codes from source not in approved Supervisory Control and Data Acquisition (SCADA) servers at rate exceeding baseline poll rate or covering address ranges outside known tag ranges |
| Field | Description |
|---|---|
| ApprovedOPCClients | Allowlist of OPC client application identities authorized to connect. |
| ApprovedSCADAServers | IP allowlist of legitimate SCADA/HMI/historian servers authorized to poll field devices. |
| BaselinePollRate | Measured normal polling frequency per device, derived from actual baseline traffic capture. |
| KnownTagAddressRanges | Documented register/tag address ranges that legitimate SCADA polling actually queries. |
Real-time monitoring identifies a scripting interpreter or custom binary on an Industrial Control System (ICS) Linux asset making sustained, high-frequency Industrial Control System (ICS) protocol read connections to field device IPs, from a User Identifier (UID) not associated with the recognized historian or Supervisory Control and Data Acquisition (SCADA) service account. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of scripting interpreter with sustained network connect() calls to device subnet at rate exceeding poll baseline, by User Identifier (UID) not in service account allowlist |
| Field | Description |
|---|---|
| ApprovedOPCClients | Allowlist of OPC client application identities authorized to connect. |
| ApprovedSCADAServers | IP allowlist of legitimate SCADA/HMI/historian servers authorized to poll field devices. |
| BaselinePollRate | Measured normal polling frequency per device, derived from actual baseline traffic capture. |
| KnownTagAddressRanges | Documented register/tag address ranges that legitimate SCADA polling actually queries. |
Real-time monitoring identifies NetFlow showing a host generating an anomalously high volume of short-duration flows to multiple field device IPs at regular intervals, from a source not in the approved Supervisory Control and Data Acquisition (SCADA) server list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | netflow:ipfix | IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): source not in approved Supervisory Control and Data Acquisition (SCADA) servers generating high volume of short-duration flows to device subnet at regular intervals |
| Field | Description |
|---|---|
| ApprovedOPCClients | Allowlist of OPC client application identities authorized to connect. |
| ApprovedSCADAServers | IP allowlist of legitimate SCADA/HMI/historian servers authorized to poll field devices. |
| BaselinePollRate | Measured normal polling frequency per device, derived from actual baseline traffic capture. |
| KnownTagAddressRanges | Documented register/tag address ranges that legitimate SCADA polling actually queries. |
Real-time monitoring identifies a process on an Industrial Control System (ICS) Windows host querying device operating state or process values via vendor Application Programming Interfaces (APIs) at a frequency or scope exceeding documented Human-Machine Interface (HMI) refresh behavior, from a process not in the recognized HMI/Supervisory Control and Data Acquisition (SCADA) application list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | opc:applog | Open Platform Communications (OPC) client polling frequency for tag set exceeds documented Human-Machine Interface (HMI) refresh baseline from client not in approved application list |
| Field | Description |
|---|---|
| ApprovedOPCClients | Allowlist of OPC client application identities authorized to connect. |
| ApprovedSCADAServers | IP allowlist of legitimate SCADA/HMI/historian servers authorized to poll field devices. |
| BaselinePollRate | Measured normal polling frequency per device, derived from actual baseline traffic capture. |
| KnownTagAddressRanges | Documented register/tag address ranges that legitimate SCADA polling actually queries. |