Real-time monitoring identifies new Internet Group Management Protocol (IGMP) joins or broadcast traffic spikes on Industrial Control System (ICS) Virtual Local Area Networks (VLANs) from a source not in the approved device inventory. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | networkdevice:snmp | new Internet Group Management Protocol (IGMP) join or broadcast traffic spike on Industrial Control Systems (ICS) Virtual Local Area Network (VLAN) from source not in approved device inventory |
| Field | Description |
|---|---|
| ApprovedDeviceInventory | MAC address inventory of devices authorized on the ICS network segment. |
Real-time monitoring identifies a Linux process sending User Datagram Protocol (UDP) broadcast packets to Industrial Control System (ICS) discovery addresses from a User Identifier (UID) not associated with any recognized ICS commissioning tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command or executable associated with the technique runs outside the approved ICS administrative/application baseline |
| Field | Description |
|---|---|
| ApprovedDeviceInventory | MAC address inventory of devices authorized on the ICS network segment. |
Real-time monitoring identifies broadcast discovery frames on the Industrial Control System (ICS) network from a source Media Access Control (MAC)/Internet Protocol (IP) address not in the approved device inventory. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | EtherNet/IP ListIdentity or Modbus broadcast from source Media Access Control (MAC) address not in approved device inventory |
| Field | Description |
|---|---|
| ApprovedDeviceInventory | MAC address inventory of devices authorized on the ICS network segment. |
Real-time monitoring identifies a Windows process sending Industrial Control System (ICS) broadcast discovery frames from a process not associated with a recognized ICS asset management or commissioning tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3 outbound User Datagram Protocol (UDP) broadcast traffic from process not in recognized Industrial Control Systems (ICS) asset management tools |
| Field | Description |
|---|---|
| ApprovedDeviceInventory | MAC address inventory of devices authorized on the ICS network segment. |