OT Protocol Anomalies

This panel detects OT-native threats—unexpected reads/writes, unusual command patterns, and protocol misuse that can indicate reconnaissance or sabotage.

• Protocol baselining by site/zone (normal command patterns, normal talkers, normal timing).
• Anomaly scoring considers function codes, frequency, payload characteristics, and endpoints.
• Correlates to assets and segmentation boundaries to identify lateral movement.

1. 1
   Investigate high-risk protocols

   and identify the talkers (engineering station, contractor VPN, rogue device).
2. 2
   Apply traffic filtering

   or segmentation rules to contain within correct conduits.
3. 3
   Harden remote access

   and require hardware-backed identity for OT operators.
4. 4
   Create allow-lists

   for safe operations and alert on any deviation.