Real-time monitoring identifies a remote service connection between two Industrial Control System (ICS) network hosts that does not match the documented, approved communication matrix, where the destination host subsequently exhibits process execution or file access inconsistent with normal automated/scheduled inter-host communication. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Logon Session Creation (DC0067) | WinEventLog:Security | Windows Security Event ID 4624/4625: EventCode=4624, Type 3/10 between Industrial Control Systems (ICS) hosts not in approved lateral movement pairs |
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3 on remote service ports (e.g., 22, 445, 3389, 5985/5986) between hosts not in approved communication matrix |
| Process Creation (DC0032) | WinEventLog:Sysmon | Microsoft-Windows-Sysmon/Operational Event ID 1 ProcessCreate: Process execution within the remote session targeting Industrial Control Systems (ICS) application directories or device subnet connections |
| Field | Description |
|---|---|
| ApprovedCommunicationMatrix | Comprehensive matrix of expected inter-host communication on remote service ports. |
| ApprovedLateralMovementPairs | Documented, approved host-to-host remote access pairs within the ICS network. |
Real-time monitoring identifies SSH lateral movement between Industrial Control System (ICS) Linux hosts not in the documented communication matrix, with subsequent ICS tool execution or privilege escalation. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): Industrial Control Systems (ICS) tool execution following Secure Shell (SSH) lateral movement session |
| Logon Session Creation (DC0067) | syslog:auth | Secure Shell (SSH) session between Industrial Control Systems (ICS) hosts not in approved lateral movement pairs |
| Field | Description |
|---|---|
| ApprovedCommunicationMatrix | Comprehensive matrix of expected inter-host communication on remote service ports. |
| ApprovedLateralMovementPairs | Documented, approved host-to-host remote access pairs within the ICS network. |
Real-time monitoring identifies new east-west connections between Industrial Control System (ICS) hosts on remote service ports not in the approved communication matrix. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | netflow:ipfix | IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): new east-west connection between Industrial Control Systems (ICS) hosts on remote service ports not in approved communication matrix |
| Field | Description |
|---|---|
| ApprovedCommunicationMatrix | Comprehensive matrix of expected inter-host communication on remote service ports. |
| ApprovedLateralMovementPairs | Documented, approved host-to-host remote access pairs within the ICS network. |
Real-time monitoring identifies Industrial Control System (ICS) protocol traffic originating from one field device Internet Protocol (IP) address to another field device, a pattern not consistent with the documented device-to-supervisory communication topology. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | NSM:Connections | field device Internet Protocol (IP) initiates connection to another field device IP, not in approved device-to-device communication matrix |
| Field | Description |
|---|---|
| ApprovedCommunicationMatrix | Comprehensive matrix of expected inter-host communication on remote service ports. |
| ApprovedLateralMovementPairs | Documented, approved host-to-host remote access pairs within the ICS network. |