Real-time monitoring identifies a Windows network-adapter disable or administrative interface-down event on an ICS gateway or protocol-converter host outside the approved network-maintenance window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | WinEventLog:System | network adapter disabled on Industrial Control Systems (ICS) gateway host by process not in authorized network admins |
| Field | Description |
|---|---|
| ApprovedNMSCIDR | IP ranges authorized for switch configuration changes. |
| ChangeControlWindow | Scheduled maintenance periods during which interface configuration changes are authorized. |
Real-time monitoring identifies ip link set down commands on Industrial Control System (ICS) Linux gateway hosts by a User Identifier (UID) not in the authorized net admin UIDs, affecting the device subnet interface. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; ip link command disables an interface on an ICS gateway outside the authorized network-administration baseline |
| Field | Description |
|---|---|
| ApprovedNMSCIDR | IP ranges authorized for switch configuration changes. |
| ChangeControlWindow | Scheduled maintenance periods during which interface configuration changes are authorized. |
Real-time monitoring identifies a switch interface transitioning to administratively-down state on a port connected to an Industrial Control System (ICS) field device, from a configuration change source not in the approved network administration list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | networkdevice:syslog | interface shutdown command on Industrial Control Systems (ICS) device port from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet outside change control window |
| Field | Description |
|---|---|
| ApprovedNMSCIDR | IP ranges authorized for switch configuration changes. |
| ChangeControlWindow | Scheduled maintenance periods during which interface configuration changes are authorized. |
Real-time monitoring identifies device_ip offline alarm coinciding with switch port admin-down syslog for that port, distinguishing deliberate Ethernet blocking from physical disconnection. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Device Alarm (DC0108) | operationaldb:AlarmEvent | device offline alarm coinciding with switch port admin-down syslog for that port |
| Field | Description |
|---|---|
| ApprovedNMSCIDR | IP ranges authorized for switch configuration changes. |
| ChangeControlWindow | Scheduled maintenance periods during which interface configuration changes are authorized. |