Real-time monitoring identifies an Industrial Control System (ICS) protocol session reading back the complete program, configuration, and data block set from a field device in a single session from a source not in the approved engineering workstation list, distinguished from a partial Program Upload by the comprehensiveness of the read. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | S7comm Upload ALL or Common Industrial Protocol (CIP) full program upload from source not in engineering workstation list, bytes_recv exceeding full upload size threshold |
| Application Log Content (DC0038) | engineeringworkstation:ApplicationLog | full upload session outside backup window schedule without documented backup purpose |
| Field | Description |
|---|---|
| BackupWindowSchedule | Scheduled periods during which routine full backups are expected. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to perform full program uploads. |
| FullUploadSizeThreshold | Byte count threshold distinguishing a full program upload from a partial/diagnostic read. |