Real-time monitoring identifies Internet Group Management Protocol (IGMP) membership reports for Industrial Control System (ICS) multicast groups from a source not in the approved device inventory. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | networkdevice:snmp | Internet Group Management Protocol (IGMP) membership report for Industrial Control Systems (ICS) multicast group from source not in approved device inventory |
| Field | Description |
|---|---|
| ApprovedDeviceInventory | MAC address inventory of devices authorized to subscribe to ICS multicast groups. |
Real-time monitoring identifies a Linux process joining Industrial Control System (ICS) multicast groups via socket() with IP_ADD_MEMBERSHIP, from a User Identifier (UID) not associated with any authorized ICS protection system monitoring application. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): socket/connect activity from a process outside the approved ICS monitoring-tool baseline to an ICS multicast destination/group |
| Field | Description |
|---|---|
| ApprovedDeviceInventory | MAC address inventory of devices authorized to subscribe to ICS multicast groups. |
Real-time monitoring identifies a new Internet Group Management Protocol (IGMP) group join or multicast subscription from a source Media Access Control (MAC)/Internet Protocol (IP) not in the approved device inventory, particularly for protection-relay Generic Object Oriented Substation Event (GOOSE) datasets. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | Internet Group Management Protocol (IGMP) join or Generic Object Oriented Substation Event (GOOSE) multicast subscription from source Media Access Control (MAC) address not in approved device inventory |
| Field | Description |
|---|---|
| ApprovedDeviceInventory | MAC address inventory of devices authorized to subscribe to ICS multicast groups. |
Real-time monitoring identifies a Windows process joining Industrial Control System (ICS) multicast groups from a process not associated with an approved ICS protection relay monitoring tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3 outbound connection from a process outside the approved ICS monitoring-tool baseline to an ICS multicast destination |
| Field | Description |
|---|---|
| ApprovedDeviceInventory | MAC address inventory of devices authorized to subscribe to ICS multicast groups. |