Real-time monitoring identifies access to Industrial Control System (ICS) documentation repositories by an account or session context not associated with documented engineering roles, immediately followed by bulk file access or archive creation. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Share Access (DC0102) | fileserver:audit | sequential access to above bulk document access threshold files within information repository time window from single session |
| Application Log Content (DC0038) | historian:applog | historian Structured Query Language (SQL) query returning above bulk query threshold rows from account not in approved historian clients |
| Logon Session Creation (DC0067) | WinEventLog:Security | Windows Security Event ID 4624/4625: EventCode=4624 by account not in authorized engineer accounts |
| Field | Description |
|---|---|
| ApprovedHistorianClients | Allowlist of applications/accounts authorized to perform bulk historian queries. |
| AuthorizedEngineerAccounts | Allowlist of accounts with documented engineering roles authorized to access ICS documentation repositories. |
| BulkDocumentAccessThreshold | File count threshold distinguishing bulk reconnaissance from routine reference lookups. |
| BulkQueryThreshold | Row count threshold for historian queries considered bulk export. |
| InformationRepositoryTimeWindow | Time window within which sequential file accesses are considered part of a single bulk collection event. |
Real-time monitoring identifies bulk file access on a Linux-hosted Industrial Control System (ICS) documentation repository (piping and instrumentation diagram stores, configuration archives) by a User Identifier (UID) not associated with documented engineering roles. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| File Access (DC0055) | auditd:SYSCALL+PATH | Linux Audit SYSCALL+PATH records: PATH records show sequential reads of ICS documentation/configuration files by a UID not in the authorized engineering or backup account set |
| Field | Description |
|---|---|
| ApprovedHistorianClients | Allowlist of applications/accounts authorized to perform bulk historian queries. |
| AuthorizedEngineerAccounts | Allowlist of accounts with documented engineering roles authorized to access ICS documentation repositories. |
| BulkDocumentAccessThreshold | File count threshold distinguishing bulk reconnaissance from routine reference lookups. |
| BulkQueryThreshold | Row count threshold for historian queries considered bulk export. |
| InformationRepositoryTimeWindow | Time window within which sequential file accesses are considered part of a single bulk collection event. |
Real-time monitoring identifies Industrial Control System (ICS) protocol sessions that bulk-read configuration data, program blocks, or data record objects from field devices, covering address ranges never queried by legitimate Supervisory Control and Data Acquisition (SCADA), suggesting systematic extraction of ICS design documentation. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | bulk configuration/program object read from source with no prior configuration-read session history |
| Field | Description |
|---|---|
| ApprovedHistorianClients | Allowlist of applications/accounts authorized to perform bulk historian queries. |
| AuthorizedEngineerAccounts | Allowlist of accounts with documented engineering roles authorized to access ICS documentation repositories. |
| BulkDocumentAccessThreshold | File count threshold distinguishing bulk reconnaissance from routine reference lookups. |
| BulkQueryThreshold | Row count threshold for historian queries considered bulk export. |
| InformationRepositoryTimeWindow | Time window within which sequential file accesses are considered part of a single bulk collection event. |
| ID | Asset |
|---|---|
| A0006 | Data Historian |
| A0007 | Control Server |