Real-time monitoring identifies an Industrial Control System (ICS) Windows host simultaneously holding connections to both the field device subnet and an unexpected external or inter-zone destination, combined with proxy-capable process spawning and ICS vendor application logs showing endpoint or certificate changes. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | vendorapp:ApplicationLog | Industrial Control Systems (ICS) vendor application log shows endpoint or certificate change without documented maintenance reference |
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3 process holds connections to both device subnet and external/inter-zone destination simultaneously, combined with proxy-capable process spawn |
| Field | Description |
|---|---|
| AiTMCorrelationWindow | Time window within which a MAC binding change and protocol baseline deviation are considered correlated. |
| ExpectedNextHopBaseline | Documented expected network path for device subnet traffic. |
| TopologyChangeTicket | Change-management reference confirming an authorized hardware replacement or topology modification. |
Real-time monitoring identifies a process on an Industrial Control System (ICS) Linux asset with both a listening socket on an ICS protocol port and an outbound connection to a non-ICS destination, combined with iptables DNAT rules redirecting ICS protocol port traffic. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command line invokes iptables/nftables to change ICS traffic filtering or redirection outside the authorized network-administration baseline |
| Network Connection Creation (DC0082) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): bind/listen/connect syscalls show one process accepting ICS-protocol connections while also initiating an outbound connection to a non-ICS destination |
| Field | Description |
|---|---|
| AiTMCorrelationWindow | Time window within which a MAC binding change and protocol baseline deviation are considered correlated. |
| ExpectedNextHopBaseline | Documented expected network path for device subnet traffic. |
| TopologyChangeTicket | Change-management reference confirming an authorized hardware replacement or topology modification. |
Real-time monitoring identifies network device configuration changes (network address translation rules, static routes, access control list modifications) combined with NetFlow path deviations for Industrial Control System (ICS) device traffic and Transport Layer Security (TLS) certificate issuer anomalies in Operational Technology (OT) management traffic. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | netflow:ipfix | IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): next-hop change for device subnet traffic or unexpected path through new gateway not in expected next-hop baseline |
| Application Log Content (DC0038) | networkdevice:syslog | Network Address Translation (NAT)/route/Access Control List (ACL) configuration change from source not in approved net admins outside config change window |
| Field | Description |
|---|---|
| AiTMCorrelationWindow | Time window within which a MAC binding change and protocol baseline deviation are considered correlated. |
| ExpectedNextHopBaseline | Documented expected network path for device subnet traffic. |
| TopologyChangeTicket | Change-management reference confirming an authorized hardware replacement or topology modification. |
Real-time network monitoring identifies a field device's source Media Access Control (MAC) address changing without a corresponding documented hardware replacement, combined with protocol-level anomalies (transaction identifier reuse, function-code patterns deviating from baseline) for traffic associated with that device Internet Protocol (IP) address. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | NSM:Content | device_ip observed with src_mac differing from enrolled hardware address without corresponding topology change ticket |
| Network Traffic Content (DC0085) | NSM:Content | transaction identifier reuse pattern or function-code distribution deviates from established per-device baseline within Adversary in the Middle (AiTM) correlation window of the Media Access Control (MAC) address binding change |
| Field | Description |
|---|---|
| AiTMCorrelationWindow | Time window within which a MAC binding change and protocol baseline deviation are considered correlated. |
| ExpectedNextHopBaseline | Documented expected network path for device subnet traffic. |
| TopologyChangeTicket | Change-management reference confirming an authorized hardware replacement or topology modification. |