Real-time network monitoring identifies a source issuing systematic, sequential Industrial Control System (ICS) protocol reads sweeping the full register/address range across multiple field devices within a short time window, from a source not in the approved control server list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | historian:applog | bulk export query returning above bulk query threshold records from account not in approved historian clients |
| Network Traffic Content (DC0085) | NSM:Content | source not in approved Supervisory Control and Data Acquisition (SCADA) servers issuing reads covering sequential address ranges across multiple device Internet Protocol (IP) addresses within auto collection time window |
| Field | Description |
|---|---|
| ApprovedHistorianClients | Allowlist of applications/accounts authorized to perform bulk historian queries. |
| ApprovedSCADAServers | IP allowlist of legitimate SCADA/historian servers. |
| AutoCollectionTimeWindow | Time window within which sequential reads across multiple devices are considered part of a single automated collection event. |
| BulkQueryThreshold | Record count threshold above which a historian query is considered a bulk export rather than a routine query. |
Real-time monitoring identifies a scripting interpreter process iterating through Industrial Control System (ICS) data sources and writing output to a local file or piping to a network socket, by a User Identifier (UID) not associated with documented automation scripts. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Script Execution (DC0029) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of scripting interpreter making sequential Industrial Control Systems (ICS) protocol reads with output to file, by User Identifier (UID) not in authorized scripting UIDs |
| Field | Description |
|---|---|
| ApprovedHistorianClients | Allowlist of applications/accounts authorized to perform bulk historian queries. |
| ApprovedSCADAServers | IP allowlist of legitimate SCADA/historian servers. |
| AutoCollectionTimeWindow | Time window within which sequential reads across multiple devices are considered part of a single automated collection event. |
| BulkQueryThreshold | Record count threshold above which a historian query is considered a bulk export rather than a routine query. |
Real-time monitoring identifies a host process making sequential Industrial Control System (ICS) protocol reads with output piped to a local staging file, from a process not associated with a recognized Human-Machine Interface (HMI) or historian tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| File Creation (DC0039) | WinEventLog:Sysmon | EventCode=11 where an unrecognized process creates a staging/output file after bulk ICS data access activity |
| Field | Description |
|---|---|
| ApprovedHistorianClients | Allowlist of applications/accounts authorized to perform bulk historian queries. |
| ApprovedSCADAServers | IP allowlist of legitimate SCADA/historian servers. |
| AutoCollectionTimeWindow | Time window within which sequential reads across multiple devices are considered part of a single automated collection event. |
| BulkQueryThreshold | Record count threshold above which a historian query is considered a bulk export rather than a routine query. |