Real-time monitoring identifies inbound connections to Industrial Control System (ICS) Windows application servers from internet-routed Internet Protocol (IP) addresses. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.
| Data Component | Name | Channel |
|---|---|---|
| Logon Session Metadata (DC0088) | WinEventLog:Security | Windows Security Event ID 4624/4625: inbound authentication attempt or successful session from internet-sourced Internet Protocol (IP) address to Industrial Control Systems (ICS) application port |
| Field | Description |
|---|---|
| OrganizationalIPSpace | Documented internal/organizational IP address ranges. |
Real-time monitoring identifies Industrial Control System (ICS) field device IPs receiving inbound connections from internet-sourced IP addresses on ICS protocol ports. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | NSM:Connections | inbound connection to field device Internet Protocol (IP) address from source outside RFC1918/organizational IP space on Industrial Control System (ICS) protocol port |
| Field | Description |
|---|---|
| OrganizationalIPSpace | Documented internal/organizational IP address ranges. |
Real-time monitoring identifies an Industrial Control System (ICS) device or server accepting an inbound connection on its native protocol port from a source Internet Protocol (IP) address outside the organization's address space. Documented in Trend Micro's manufacturing honeypot research, with adversaries exploiting exposed Siemens S7, Omron Factory Interface Network Service (FINS), EtherNet/IP, and misconfigured Virtual Network Computing (VNC). OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | perimeter:firewall | inbound connection to Industrial Control Systems (ICS) device/server Internet Protocol (IP) address on ICS protocol port from source not in organizational IP space |
| Field | Description |
|---|---|
| OrganizationalIPSpace | Documented internal/organizational IP address ranges. |
Real-time monitoring identifies Secure Shell (SSH), web application, or Industrial Control System (ICS) Application Programming Interface (API) authentication attempts on ICS Linux servers from internet-sourced Internet Protocol (IP) addresses. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.
| Data Component | Name | Channel |
|---|---|---|
| Logon Session Metadata (DC0088) | syslog:auth | authentication attempt or success from internet-sourced Internet Protocol (IP) address not in organizational IP space |
| Field | Description |
|---|---|
| OrganizationalIPSpace | Documented internal/organizational IP address ranges. |
| ID | Asset |
|---|---|
| A0001 | Workstation |
| A0008 | Application Server |
| A0011 | Virtual Private Network (VPN) Server |
| A0015 | Switch |
| A0016 | Firewall |