Real-time monitoring identifies iptables/nftables rule changes on Industrial Control System (ICS) Linux gateways that selectively block one ICS communication traffic type. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command line invokes iptables/nftables to change ICS traffic filtering or redirection outside the authorized network-administration baseline |
| Field | Description |
|---|---|
| CommunicationGapThreshold | Time threshold beyond the expected communication interval that constitutes a gap warranting investigation. |
Real-time monitoring identifies an abrupt cessation of expected Industrial Control System (ICS) protocol traffic between a Supervisory Control and Data Acquisition (SCADA)/control server and a field device, without a corresponding device alarm or scheduled maintenance event, while the device remains reachable for at least some traffic types. This technique-level analytic synthesizes Command Message blocking (T1691.001) and Reporting Message blocking (T1691.002). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Process/Event Alarm (DC0109) | operationaldb:AlarmEvent | expected communication absent for device_ip without corresponding device-generated alarm explaining the gap |
| Network Traffic Flow (DC0078) | NSM:Connections | one Industrial Control System (ICS) traffic type (command or reporting) to/from device_ip ceases while other traffic types continue normally |
| Field | Description |
|---|---|
| CommunicationGapThreshold | Time threshold beyond the expected communication interval that constitutes a gap warranting investigation. |
Real-time monitoring identifies Windows host-based firewall or network policy changes that selectively block Industrial Control System (ICS) communication traffic types from Supervisory Control and Data Acquisition (SCADA)/Distributed Control System (DCS) hosts. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Firewall Rule Modification (DC0051) | WinEventLog:Security | Windows Security Windows Filtering Platform / Firewall audit events (policy-dependent): firewall rule change selectively blocking one Industrial Control Systems (ICS) traffic type from Supervisory Control and Data Acquisition (SCADA)/Distributed Control System (DCS) host without corresponding change ticket |
| Field | Description |
|---|---|
| CommunicationGapThreshold | Time threshold beyond the expected communication interval that constitutes a gap warranting investigation. |