Real-time monitoring identifies a device establishing its first network connection to Industrial Control System (ICS) application servers from an Internet Protocol (IP) address or Media Access Control (MAC) address not previously seen in the environment, immediately following a new device association event on the network. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | netflow:ipfix | IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection from newly-observed device to Industrial Control Systems (ICS) application server within new device window of first network appearance |
| Logon Session Creation (DC0067) | WinEventLog:Security | Windows Security Event ID 4624/4625: EventCode=4624 from a device Media Access Control (MAC) address/hardware-ID first observed on the network, not in approved device inventory |
| Field | Description |
|---|---|
| ApprovedDeviceInventory | Hardware ID inventory of all devices authorized to connect to the ICS network, ideally enforced via NAC/802.1X. |
| NewDeviceWindow | Time window after first network appearance within which access to ICS systems is considered part of the same onboarding/intrusion event. |
Real-time monitoring identifies an Secure Shell (SSH) connection to an Industrial Control System (ICS) Linux asset from a source Internet Protocol (IP) address that appeared on the ICS network within a short window and is not in the approved device inventory. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | syslog:auth | Secure Shell (SSH) connection from source Internet Protocol (IP) address that appeared on Industrial Control Systems (ICS) network within new device window, not in approved device inventory |
| Field | Description |
|---|---|
| ApprovedDeviceInventory | Hardware ID inventory of all devices authorized to connect to the ICS network, ideally enforced via NAC/802.1X. |
| NewDeviceWindow | Time window after first network appearance within which access to ICS systems is considered part of the same onboarding/intrusion event. |
| ID | Asset |
|---|---|
| A0001 | Workstation |