OT / ICS detection patterns.
In operational technology you watch without touching. Detections are passive, model the physical process rather than just the packets, and concentrate on the boundary where IT reaches into OT — because that boundary is where the intrusions cross.
Passive by default
OT networks do not tolerate active scanning. Collection is passive — a SPAN port or tap mirrors traffic to the fabric — so threatDefendr observes the control network without ever sending a packet onto it.
Model the process
The strongest OT signal is physical, not digital: a setpoint that moves outside its safe band, or a command sequence that breaks the normal operational order. Model the process and the anomaly is a deviation from how the plant actually runs.
YAMLsetpoint deviation when: stream: ot.process match: tag: reactor-1.temp_setpoint value: { outside: [180, 220] } # safe operating band window: 30s
Watch the IT/OT boundary
Most OT intrusions arrive from IT. Concentrate detections on the crossing points — the jump hosts, historians, and engineering workstations that bridge the two — where a foothold first becomes visible.
| Boundary asset | Watch for |
|---|---|
| Jump host / engineering WS | New remote sessions, unsigned tools, off-hours access. |
| Historian | Bulk reads, new outbound destinations. |
| Protocol gateway | Unexpected write commands, protocol downgrades. |
Where to go next
- Critical infrastructure — the full sector view.
- Cross-stream joins — correlate IT and OT signals.