Real-time monitoring identifies an Industrial Control System (ICS) protocol session reading back the user program from a field device to a source not in the approved engineering workstation list, where the session byte count is consistent with a substantial portion of the device's program memory. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | S7comm Upload Block / Common Industrial Protocol (CIP) Read Program session from source not in engineering workstation list with bytes_recv exceeding program upload size threshold |
| Application Log Content (DC0038) | engineeringworkstation:ApplicationLog | Engineering application audit/session log: controller program upload initiated outside approved backup/change window and without documented backup purpose |
| Field | Description |
|---|---|
| BackupWindowSchedule | Scheduled periods during which routine backup uploads are expected. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to perform program uploads from field devices. |
| ProgramUploadSizeThreshold | Minimum byte count for a session to be considered a substantial program readback. |