Real-time monitoring identifies an interactive desktop session Remote Desktop Protocol (RDP), Virtual Network Computing (VNC), or vendor remote console to an Human-Machine Interface (HMI) or engineering station from a source Internet Protocol (IP) addresses outside the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, or from an account not in the approved operator/engineer list, where the session subsequently interacts with Industrial Control System (ICS) control elements. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Logon Session Creation (DC0067) | WinEventLog:Security | Windows Security Event ID 4624/4625: EventCode=4624, Type 2/10 to Industrial Control Systems (ICS) host from source not in approved operator workstations or account not in approved operator list |
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 process execution associated with a remote session targets ICS application directories or initiates device-subnet activity |
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3 network connection to an RDP/VNC service on an ICS Windows host from a source outside the approved management CIDR baseline |
| Field | Description |
|---|---|
| ApprovedManagementCIDR | IP ranges authorized for remote desktop/console access to ICS hosts. |
| ApprovedOperatorList | Accounts with documented operator/engineer roles. |
| ApprovedOperatorWorkstations | Inventory of workstations from which operator/engineer interactive sessions are expected to originate. |
Real-time monitoring identifies Secure Shell (SSH) sessions with X11 forwarding or Virtual Network Computing (VNC) connections to Industrial Control System (ICS) Linux hosts from unexpected source Internet Protocol (IP) addresses, combined with X11 application launches from the session. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; ICS HMI/GUI application launched from an SSH-associated process/session outside the approved remote-administration baseline |
| Application Log Content (DC0038) | syslog:auth | Secure Shell (SSH) session with X11 forwarding from source not in approved admin Classless Inter-Domain Routing (CIDR) subnet |
| Field | Description |
|---|---|
| ApprovedManagementCIDR | IP ranges authorized for remote desktop/console access to ICS hosts. |
| ApprovedOperatorList | Accounts with documented operator/engineer roles. |
| ApprovedOperatorWorkstations | Inventory of workstations from which operator/engineer interactive sessions are expected to originate. |
Real-time monitoring identifies remote console or web management sessions to Industrial Control System (ICS) network devices from IP addresses that are not approved Network Management System (NMS) hosts, where the sessions access device configuration interfaces. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | networkdevice:syslog | remote console or web management session from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet |
| Field | Description |
|---|---|
| ApprovedManagementCIDR | IP ranges authorized for remote desktop/console access to ICS hosts. |
| ApprovedOperatorList | Accounts with documented operator/engineer roles. |
| ApprovedOperatorWorkstations | Inventory of workstations from which operator/engineer interactive sessions are expected to originate. |
Real-time monitoring identifies Virtual Network Computing (VNC) or proprietary remote console sessions to embedded Human-Machine Interface (HMI) panels or operator terminals from IP addresses outside the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, where the sessions access Industrial Control System (ICS) control interfaces with physical-plant impact. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | Virtual Network Computing (VNC) or remote console session to embedded Human-Machine Interface (HMI) panel from source not in approved management Classless Inter-Domain Routing (CIDR) subnet |
| Field | Description |
|---|---|
| ApprovedManagementCIDR | IP ranges authorized for remote desktop/console access to ICS hosts. |
| ApprovedOperatorList | Accounts with documented operator/engineer roles. |
| ApprovedOperatorWorkstations | Inventory of workstations from which operator/engineer interactive sessions are expected to originate. |
| ID | Asset |
|---|---|
| A0001 | Workstation |
| A0002 | Human-Machine Interface (HMI) |
| A0006 | Data Historian |
| A0007 | Control Server |
| A0008 | Application Server |
| A0009 | Data Gateway |
| A0012 | Jump Host |
| A0015 | Switch |
| A0016 | Firewall |