Real-time monitoring identifies a network infrastructure configuration change that results in a communication gap between previously-connected Industrial Control System (ICS) zones, from a source not in the approved network administration list. This technique-level analytic synthesizes Serial COM (T1695.001), Ethernet (T1695.002), and Wi-Fi (T1695.003). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | networkdevice:syslog | Access Control List (ACL)/firewall/routing configuration change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet outside change control window |
| Process/Event Alarm (DC0109) | operationaldb:AlarmEvent | communication-loss alarm for affected devices within comm block correlation window of the flagged configuration change |
| Field | Description |
|---|---|
| ApprovedNMSCIDR | IP ranges authorized for network infrastructure configuration changes. |
| ChangeControlWindow | Scheduled maintenance periods during which connectivity-affecting changes are authorized. |
| CommBlockCorrelationWindow | Time window correlating a configuration change with subsequent communication loss. |
Real-time monitoring identifies iptables/nftables rule additions blocking Industrial Control System (ICS) protocol ports on Linux ICS gateways. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; iptables/nftables command adds a rule that blocks ICS protocol traffic outside the authorized network-administration baseline |
| Field | Description |
|---|---|
| ApprovedNMSCIDR | IP ranges authorized for network infrastructure configuration changes. |
| ChangeControlWindow | Scheduled maintenance periods during which connectivity-affecting changes are authorized. |
| CommBlockCorrelationWindow | Time window correlating a configuration change with subsequent communication loss. |
Real-time monitoring identifies multiple field devices becoming unreachable simultaneously following a network infrastructure configuration change event. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | NSM:Connections | multiple device Internet Protocol (IP) addresses become unreachable simultaneously following network infrastructure config change event |
| Field | Description |
|---|---|
| ApprovedNMSCIDR | IP ranges authorized for network infrastructure configuration changes. |
| ChangeControlWindow | Scheduled maintenance periods during which connectivity-affecting changes are authorized. |
| CommBlockCorrelationWindow | Time window correlating a configuration change with subsequent communication loss. |
Real-time monitoring identifies Windows firewall rule additions blocking Industrial Control System (ICS) protocol ports on ICS gateway or server hosts. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Firewall Metadata (DC0053) | WinEventLog:Security | Windows Security Windows Filtering Platform / Firewall audit events (policy-dependent): Windows Firewall rule added blocking Industrial Control Systems (ICS) protocol ports by account not in authorized firewall admins |
| Field | Description |
|---|---|
| ApprovedNMSCIDR | IP ranges authorized for network infrastructure configuration changes. |
| ChangeControlWindow | Scheduled maintenance periods during which connectivity-affecting changes are authorized. |
| CommBlockCorrelationWindow | Time window correlating a configuration change with subsequent communication loss. |