Real-time monitoring identifies Domain Name System (DNS) queries from Industrial Control System (ICS) host Internet Protocol (IP) addresses to external resolvers for domains not associated with any approved ICS vendor, particularly domains exhibiting Domain Generation Algorithm (DGA)-like patterns. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | dns:querylog | Domain Name System (DNS) query from Industrial Control Systems (ICS) host to domain not in approved vendor domains, particularly domains exhibiting Domain Generation Algorithm (DGA)-like patterns |
| Field | Description |
|---|---|
| ApprovedVendorDomains | Allowlist of legitimate vendor/business domains for application-layer protocol traffic. |
| NoExternalConnectivityRoleList | Inventory of ICS hosts whose role does not require external application-layer connectivity. |
Real-time monitoring identifies Industrial Control System (ICS) Linux service processes initiating outbound application-layer protocol connections to ports/destinations outside the approved communication matrix. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): connect syscall from an ICS service/application process to a destination outside the approved network or vendor-service baseline |
| Field | Description |
|---|---|
| ApprovedVendorDomains | Allowlist of legitimate vendor/business domains for application-layer protocol traffic. |
| NoExternalConnectivityRoleList | Inventory of ICS hosts whose role does not require external application-layer connectivity. |
Near-real-time connection monitoring identifies an embedded field device or gateway initiating outbound connections on standard application-layer protocol ports to destinations outside the expected Industrial Control System (ICS) communication baseline. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity. This analytic is implementable from session/flow metadata (endpoints, ports, protocol/service, timing, bytes); it does not require or claim packet-payload visibility.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | NSM:Connections | Connection/session metadata: embedded device opens HTTP/HTTPS/DNS session to destination outside approved ICS communication baseline |
| Field | Description |
|---|---|
| ApprovedVendorDomains | Allowlist of legitimate vendor/business domains for application-layer protocol traffic. |
| NoExternalConnectivityRoleList | Inventory of ICS hosts whose role does not require external application-layer connectivity. |
Real-time monitoring identifies an Industrial Control System (ICS) Windows host making outbound connections on HTTP/HTTPS/DNS ports to destinations outside the approved Industrial Control System (ICS) communication baseline, from processes that are not recognized Industrial Control System (ICS) vendor applications. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3 on Hypertext Transfer Protocol (HTTP)/Hypertext Transfer Protocol Secure (HTTPS)/Domain Name System (DNS) port from process not recognized as Industrial Control Systems (ICS) vendor application |
| Field | Description |
|---|---|
| ApprovedVendorDomains | Allowlist of legitimate vendor/business domains for application-layer protocol traffic. |
| NoExternalConnectivityRoleList | Inventory of ICS hosts whose role does not require external application-layer connectivity. |