Real-time monitoring identifies an Industrial Control System (ICS) protocol session adding new program blocks or routines to an existing controller program without replacing existing logic, from a source not in the approved engineering workstation list, correlated against the device's program inventory showing a size increase without a corresponding planned update. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Asset Inventory (DC0110) | assetinventory:ProgramSize | device program size/block count increases without corresponding change ticket reference |
| Network Traffic Content (DC0085) | NSM:Content | download of block address not previously present in device program inventory, from source not in engineering workstation list |
| Field | Description |
|---|---|
| EngineeringWorkstationList | IP allowlist of workstations authorized to append program blocks. |