Real-time monitoring identifies iptables/nftables rules on Industrial Control System (ICS) Linux gateways that selectively drop ICS reporting message traffic based on content while allowing command traffic to pass. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command line invokes iptables/nftables to change ICS traffic filtering or redirection outside the authorized network-administration baseline |
| Field | Description |
|---|---|
| ExpectedReportingInterval | Device-specific configured interval for unsolicited reporting. |
Real-time monitoring identifies ACL modifications on Industrial Control System (ICS) network devices specifically blocking ICS reporting message ports while allowing command ports to remain open. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | networkdevice:syslog | Access Control List (ACL) modification blocking Industrial Control Systems (ICS) reporting message ports while command ports remain open |
| Field | Description |
|---|---|
| ExpectedReportingInterval | Device-specific configured interval for unsolicited reporting. |
Real-time monitoring identifies a field device ceasing to send expected unsolicited reports or periodic status updates without a corresponding device alarm or maintenance event, while the device remains reachable via direct polling. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Process History/Live Data (DC0107) | operationaldb:ProcessHistory | no unsolicited report received from device_ip within 1.5x expected reporting interval, while direct polling confirms device is reachable |
| Network Traffic Flow (DC0078) | NSM:Connections | device_ip generates no outbound unsolicited traffic while responding normally to inbound polls |
| Field | Description |
|---|---|
| ExpectedReportingInterval | Device-specific configured interval for unsolicited reporting. |
Real-time monitoring identifies Windows firewall changes blocking unsolicited Industrial Control System (ICS) reporting traffic while leaving polling/command traffic unaffected, resulting in Supervisory Control and Data Acquisition (SCADA) losing event-driven visibility while retaining polling capability. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Firewall Rule Modification (DC0051) | WinEventLog:Security | Windows Security Windows Filtering Platform / Firewall audit events (policy-dependent): firewall rule change blocking unsolicited Industrial Control Systems (ICS) reporting traffic while command/polling traffic continues |
| Field | Description |
|---|---|
| ExpectedReportingInterval | Device-specific configured interval for unsolicited reporting. |