Real-time monitoring identifies an Industrial Control System (ICS) online-edit command sequence (incremental program modification while the device remains in RUN mode) from a source not in the approved engineering workstation list, outside a scheduled change-control window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | online block edit service from source not in engineering workstation list outside change control window, with device remaining in RUN mode throughout |
| Application Log Content (DC0038) | engineeringworkstation:ApplicationLog | online edit session logged without corresponding change ticket reference |
| Field | Description |
|---|---|
| ChangeControlWindow | Scheduled maintenance periods during which online edits are authorized. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to perform online edits. |