Real-time monitoring identifies an Industrial Control System (ICS) protocol session that systematically enumerates a device's full tag/object namespace from a source not in the approved control server list, where the enumeration pattern covers the complete address/object space rather than the sparse, fixed tag set legitimate Supervisory Control and Data Acquisition (SCADA) polling queries. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | opc:applog | client_id not in approved Open Platform Communications (OPC) clients traversing entire tag tree rather than known fixed subset |
| Network Traffic Content (DC0085) | NSM:Content | Open Platform Communications Unified Architecture (OPC UA) BrowseNamespace or Distributed Network Protocol 3 (DNP3) object 0 all-variation read or Common Industrial Protocol (CIP) Get_Attributes_All from source not in approved Supervisory Control and Data Acquisition (SCADA) servers, covering above namespace coverage threshold percent of device tag space |
| Field | Description |
|---|---|
| ApprovedOPCClients | Allowlist of OPC client identities authorized for namespace browsing. |
| ApprovedSCADAServers | IP allowlist of legitimate polling/browsing sources. |
| NamespaceCoverageThreshold | Percentage of total device tag/object space accessed within a session constituting full enumeration. |
Real-time monitoring identifies an Open Platform Communications (OPC) Unified Architecture (UA) client process on a Linux Industrial Control System (ICS) host calling browse/enumerate operations against the full namespace, from a User Identifier (UID) not associated with recognized monitoring tools. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | OPC UA Browse/BrowseNext request to namespace or system-information objects from a client identity or source not in the approved monitoring baseline |
| Field | Description |
|---|---|
| ApprovedOPCClients | Allowlist of OPC client identities authorized for namespace browsing. |
| ApprovedSCADAServers | IP allowlist of legitimate polling/browsing sources. |
| NamespaceCoverageThreshold | Percentage of total device tag/object space accessed within a session constituting full enumeration. |
Real-time monitoring identifies NetFlow showing a source making sequential connections to multiple field device Internet Protocol (IP) addresses, each resulting in large response payloads characteristic of directory listing rather than value reads. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | netflow:ipfix | IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): sequential connections from single source to multiple device Internet Protocol (IP) addresses resulting in large response payloads characteristic of directory listing |
| Field | Description |
|---|---|
| ApprovedOPCClients | Allowlist of OPC client identities authorized for namespace browsing. |
| ApprovedSCADAServers | IP allowlist of legitimate polling/browsing sources. |
| NamespaceCoverageThreshold | Percentage of total device tag/object space accessed within a session constituting full enumeration. |
Real-time monitoring identifies an Open Platform Communications (OPC) client process on an Industrial Control System (ICS) Windows host calling BrowseNamespace or GetProperties to enumerate the full tag tree, from a process not associated with a recognized Human-Machine Interface (HMI) or historian tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | opc:applog | Open Platform Communications (OPC) client not in approved OPC clients calling BrowseNamespace traversing entire tag tree |
| Field | Description |
|---|---|
| ApprovedOPCClients | Allowlist of OPC client identities authorized for namespace browsing. |
| ApprovedSCADAServers | IP allowlist of legitimate polling/browsing sources. |
| NamespaceCoverageThreshold | Percentage of total device tag/object space accessed within a session constituting full enumeration. |