Real-time monitoring identifies execution of network enumeration commands (netstat, arp -a, Get-NetTCPConnection) on an Industrial Control System (ICS) host from an account not associated with documented network administration, where multiple such commands execute in sequence within a short window. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 network enumeration command from account not in approved network admins, with more than one distinct command within enumeration time window |
| Field | Description |
|---|---|
| ApprovedNetworkAdmins | Accounts with documented network administration responsibilities. |
| ApprovedSCADAServers | IP allowlist of legitimate sources for topology queries. |
| EnumerationTimeWindow | Time window within which multiple enumeration commands are considered a systematic mapping sequence. |
Real-time monitoring identifies execution of network enumeration tools (ss, netstat, arp, ip neigh) on an Industrial Control System (ICS) Linux asset from a User Identifier (UID) that does not normally perform network administration. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; network-enumeration utility launched by a UID not in the authorized network-administration set |
| Field | Description |
|---|---|
| ApprovedNetworkAdmins | Accounts with documented network administration responsibilities. |
| ApprovedSCADAServers | IP allowlist of legitimate sources for topology queries. |
| EnumerationTimeWindow | Time window within which multiple enumeration commands are considered a systematic mapping sequence. |
Real-time monitoring identifies Simple Network Management Protocol (SNMP) walk requests, Cisco Discovery Protocol (CDP)/Link Layer Discovery Protocol (LLDP) enumeration frames, or Internet Control Message Protocol (ICMP)-based traceroute sequences from an Industrial Control System (ICS) host that has not previously generated management-protocol traffic. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | networkdevice:snmp | Simple Network Management Protocol (SNMP) walk request from source not in approved Network Management System (NMS) Class Inter-Domain Routing (CIDR) subnet |
| Field | Description |
|---|---|
| ApprovedNetworkAdmins | Accounts with documented network administration responsibilities. |
| ApprovedSCADAServers | IP allowlist of legitimate sources for topology queries. |
| EnumerationTimeWindow | Time window within which multiple enumeration commands are considered a systematic mapping sequence. |
Real-time monitoring identifies Industrial Control System (ICS) protocol messages querying network topology information from embedded devices -- neighbor device lists, Common Industrial Protocol (CIP) port object information -- from a source not in the approved control server list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | CIP Port Object Get_Attribute_All or topology query from source not in approved Supervisory Control and Data Acquisition (SCADA) servers |
| Field | Description |
|---|---|
| ApprovedNetworkAdmins | Accounts with documented network administration responsibilities. |
| ApprovedSCADAServers | IP allowlist of legitimate sources for topology queries. |
| EnumerationTimeWindow | Time window within which multiple enumeration commands are considered a systematic mapping sequence. |