Real-time monitoring identifies an Industrial Control System (ICS) protocol write to an existing program block from a source not in the approved engineering workstation list, outside a scheduled change-control window, correlated against post-modification program hash comparison and measurable change in controller Input/Output (I/O) behavior. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Software (DC0111) | assetinventory:ProgramHash | program hash differs from last authorized baseline without corresponding change ticket reference |
| Network Traffic Content (DC0085) | NSM:Content | write to existing program block address from source not in engineering workstation list outside change control window |
| Device Alarm (DC0108) | device:VendorLog | measurable change in scan cycle timing or Input/Output (I/O) update pattern following a flagged program write |
| Field | Description |
|---|---|
| ChangeControlWindow | Scheduled maintenance periods during which program modifications are authorized. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to modify existing controller program blocks. |