Real-time monitoring identifies an Industrial Control System (ICS) protocol write to output register addresses on a field device from a source not in the approved write-source list, correlated with a discrepancy between the value reported by the Input/Output (I/O) image and an independent measurement of the actual physical output state. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. The independent measurement is process-state telemetry, not network-flow evidence; implementation requires a separately trusted sensor/historian/measurement path with time alignment and an engineering-defined tolerance.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | NSM:Content | write function code to output register address range from source not in approved write sources |
| Process History/Live Data (DC0107) | processsensor:RedundantComparison | Independent process measurement comparison: controller I/O image value diverges from independent sensor/measurement beyond configured integrity tolerance |
| Field | Description |
|---|---|
| ApprovedWriteSources | IP allowlist of sources authorized to write to I/O output registers. |
| IOIntegrityToleranceThreshold | Acceptable divergence between reported I/O image value and independently measured physical state. |
| OutputRegisterAddressRange | Register/address ranges corresponding to physical outputs for the device type. |