Real-time monitoring of the alarm and process historian layer identifies an alarm status transitioning to suppressed, shelved, disabled, or acknowledged without a corresponding operator action recorded within a grace period, correlated with Industrial Control System (ICS) protocol write traffic to alarm configuration or threshold registers arriving in the same window from a source not in the approved engineering list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Process/Event Alarm (DC0109) | operationaldb:AlarmEvent | alarm status transitions to suppressed/shelved/disabled/acknowledged without matching operator_id entry within suppress grace period |
| Process History/Live Data (DC0107) | operationaldb:ProcessHistory | process value crosses known alarm threshold but no corresponding alarm event recorded within expected latency window |
| Network Traffic Content (DC0085) | NSM:Content | Generic Object Oriented Substation Event (GOOSE) dataset stNum value decreases (replay indicator) or test-mode bit asserted on protection relay without scheduled maintenance |
| Network Traffic Flow (DC0078) | NSM:Content | write function code targeting alarm config address range from source not in approved write sources within suppress grace period of the alarm status change |
| Field | Description |
|---|---|
| AlarmConfigAddressRange | Protocol register/address ranges corresponding to alarm threshold and configuration values per device type. |
| AlarmConfigPaths | File system paths for alarm configuration files/databases on Windows alarm servers. |
| ApprovedWriteSources | IP allowlist of sources authorized to write to ICS devices, including alarm configuration. |
| HMIAlarmParentAllowlist | Allowlist of recognized HMI/alarm management application processes authorized to modify alarm configuration. |
| SuppressGracePeriod | Time window within which a legitimate operator acknowledgment is expected following an alarm status change, typically 10-30 seconds. |
Real-time monitoring identifies a write to alarm configuration files on a Linux-based Supervisory Control and Data Acquisition (SCADA)/alarm server by a User Identifier (UID) that is not the alarm management service, or the alarm management service process receiving Application Programming Interface (API) calls that suppress alarm classes without a corresponding operator session. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Device Alarm (DC0108) | alarmserver:ApplicationLog | alarm suppression Application Programming Interface (API) call logged without operator session identifier (ID) |
| File Modification (DC0061) | auditd:SYSCALL+PATH | Linux Audit SYSCALL+PATH records: write to Industrial Control Systems (ICS) alarm configuration file by User Identifier (UID) not in authorized alarm admin UIDs |
| Field | Description |
|---|---|
| AlarmConfigAddressRange | Protocol register/address ranges corresponding to alarm threshold and configuration values per device type. |
| AlarmConfigPaths | File system paths for alarm configuration files/databases on Windows alarm servers. |
| ApprovedWriteSources | IP allowlist of sources authorized to write to ICS devices, including alarm configuration. |
| HMIAlarmParentAllowlist | Allowlist of recognized HMI/alarm management application processes authorized to modify alarm configuration. |
| SuppressGracePeriod | Time window within which a legitimate operator acknowledgment is expected following an alarm status change, typically 10-30 seconds. |
Real-time monitoring identifies a write to alarm configuration files or database tables on an Human-Machine Interface (HMI)/alarm server by a process other than the recognized alarm management application, or an alarm-class-disable Application Programming Interface (API) call logged without a corresponding operator session ID in the HMI audit trail. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Device Alarm (DC0108) | alarmserver:ApplicationLog | alarm class disabled or suppressed Application Programming Interface (API) event logged without operator_id field populated |
| File Creation (DC0039) | WinEventLog:Sysmon | EventCode=11 of alarm config paths by image not in Human-Machine Interface (HMI) alarm parent allowlist |
| Field | Description |
|---|---|
| AlarmConfigAddressRange | Protocol register/address ranges corresponding to alarm threshold and configuration values per device type. |
| AlarmConfigPaths | File system paths for alarm configuration files/databases on Windows alarm servers. |
| ApprovedWriteSources | IP allowlist of sources authorized to write to ICS devices, including alarm configuration. |
| HMIAlarmParentAllowlist | Allowlist of recognized HMI/alarm management application processes authorized to modify alarm configuration. |
| SuppressGracePeriod | Time window within which a legitimate operator acknowledgment is expected following an alarm status change, typically 10-30 seconds. |
Real-time monitoring identifies a network-device ACL, filter, or rate-limit policy change that suppresses or blocks ICS alarm-notification traffic outside the approved network-change baseline. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | networkdevice:syslog | Access Control List (ACL)/policy change affecting alarm notification traffic ports without corresponding change ticket |
| Field | Description |
|---|---|
| AlarmConfigAddressRange | Protocol register/address ranges corresponding to alarm threshold and configuration values per device type. |
| AlarmConfigPaths | File system paths for alarm configuration files/databases on Windows alarm servers. |
| ApprovedWriteSources | IP allowlist of sources authorized to write to ICS devices, including alarm configuration. |
| HMIAlarmParentAllowlist | Allowlist of recognized HMI/alarm management application processes authorized to modify alarm configuration. |
| SuppressGracePeriod | Time window within which a legitimate operator acknowledgment is expected following an alarm status change, typically 10-30 seconds. |