Skip to content

scada.md

Latest commit

 

History

History
346 lines (267 loc) · 8.65 KB

scada.md

File metadata and controls

346 lines (267 loc) · 8.65 KB
Raw

SCADA Pack

  • Name: scada
  • Version: 0.1.0
  • Schema: v1
  • Owner: scalytics
  • Core minimum version: 0.5.0

SCADA and critical infrastructure pack for plant, process, and change workflows.

Entity Types

  • alarm
  • alarm_event
  • change
  • device
  • engineer
  • firmware
  • plant
  • process
  • session
  • tag
  • tradecraft
  • vendor_tech
  • vulnerability
  • work_order
  • zone

Edge Types

  • applied
  • authenticated_on
  • controls
  • defined_on
  • device_runs
  • fired_on
  • in
  • justified_by
  • modified
  • reports
  • vulnerable_to

Map Layers

ID Name Kind Entity Types Render
plant-sites Plant Sites overlay plant point
safety-zones Safety Zones overlay zone polygon

Detectors

alarm-flood-after-change

  • Severity: high
  • Window: 24h
  • Explanation: Change {{change_id}} was followed by an alarm flood on {{tag_id}}.
  • Suggested actions:
    • inspect downstream alarm thresholds and tag writes
    • compare the flood window against recent configuration changes
SELECT change_id, tag_id, alarm_count, flood_started_at
  FROM view_scada_alarm_flood_after_change
 WHERE flood_started_at >= :window_start

change-without-work-order

  • Severity: medium
  • Window: 15m
  • Explanation: Change {{change_id}} touched {{device_id}} without a linked work order in the active window.
  • Suggested actions:
    • confirm the change request is authorized
    • attach the missing work order or open an incident
SELECT change_id, engineer_id, device_id, applied_at
  FROM view_scada_changes_without_work_order
 WHERE applied_at >= :window_start

firmware-drift

  • Severity: medium
  • Window: 168h
  • Explanation: Device {{device_id}} is running {{observed_firmware}} instead of the expected {{expected_firmware}}.
  • Suggested actions:
    • validate the approved firmware baseline for the asset
    • check whether the observed firmware came from an authorized change
SELECT device_id, expected_firmware, observed_firmware, criticality
  FROM view_scada_firmware_drift
 WHERE observed_at >= :window_start
   AND expected_firmware <> observed_firmware

purdue-violation

  • Severity: high
  • Window: 24h
  • Explanation: {{src_device_id}} communicated directly with {{dst_device_id}} across a prohibited Purdue boundary.
  • Suggested actions:
    • validate conduit and segmentation policy exceptions
    • inspect the initiating session and recent network changes
SELECT src_device_id, dst_device_id, observed_at
  FROM view_scada_purdue_violations
 WHERE observed_at >= :window_start

stale-session

  • Severity: medium
  • Window: 48h
  • Explanation: Session {{session_id}} remained open on {{device_id}} for {{open_hours}} hours.
  • Suggested actions:
    • review session activity and terminal ownership
    • terminate or rotate credentials if the session is no longer justified
SELECT session_id, engineer_id, device_id, open_hours
  FROM view_scada_stale_sessions
 WHERE observed_at >= :window_start
   AND open_hours > 24

tradecraft-match

  • Severity: high
  • Window: 168h
  • Explanation: Activity on {{device_id}} matched the {{pattern_id}} ICS tradecraft pattern.
  • Suggested actions:
    • reconstruct the full write sequence for the matched pattern
    • isolate affected engineering workstations and PLCs for review
SELECT pattern_id, device_id, matched_at
  FROM view_scada_tradecraft_matches
 WHERE matched_at >= :window_start

Views

alarm_event

  • Entity type: alarm_event
  • Title: Alarm Event
Field Label Format Hidden
alarm_id Alarm false
severity Severity false
tag_id Tag false
fired_at Fired At false

change

  • Entity type: change
  • Title: Change
Field Label Format Hidden
change_type Change Type false
device_id Device false
engineer_id Engineer false
applied_at Applied At false

device

  • Entity type: device
  • Title: Device
Field Label Format Hidden
asset_id Asset ID false
vendor Vendor false
firmware_version Firmware false
zone Zone false

plant

  • Entity type: plant
  • Title: Plant
Field Label Format Hidden
site_name Site Name false
criticality Criticality false
operator Operator false
status Status false

process

  • Entity type: process
  • Title: Process
Field Label Format Hidden
process_name Process false
zone_id Zone false
owner Owner false
state State false

tag

  • Entity type: tag
  • Title: Tag
Field Label Format Hidden
tag_name Tag false
process_id Process false
quality Quality false
last_value Last Value false

tradecraft

  • Entity type: tradecraft
  • Title: Tradecraft
Field Label Format Hidden
pattern_id Pattern false
framework Framework false
family Family false
confidence Confidence false

vulnerability

  • Entity type: vulnerability
  • Title: Vulnerability
Field Label Format Hidden
cve CVE false
severity Severity false
affected_family Affected Family false
published_at Published At false

zone

  • Entity type: zone
  • Title: Zone
Field Label Format Hidden
purdue_level Purdue Level false
zone_name Zone false
plant_id Plant false
criticality Criticality false

Query Templates

changes-to-tags-in-last-72h

  • Title: Every Change To Tags A, B, C In Last 72h
  • Description: Return recent changes touching selected tags inside the last 72 hours.
Parameter Type Required Description
tag_id string true Tag
window_start string true Window Start 
SELECT change_id, device_id, applied_at
  FROM view_scada_tag_changes
 WHERE tag_id = :tag_id
   AND applied_at >= :window_start
 ORDER BY applied_at DESC

changes-without-work-order-in-30d

  • Title: Every Change Without Work Order In 30d
  • Description: Find unlinked engineering changes in the last thirty days.
Parameter Type Required Description
window_start string true Window Start 
SELECT change_id, device_id, engineer_id, applied_at
  FROM view_scada_changes_without_work_order
 WHERE applied_at >= :window_start
 ORDER BY applied_at DESC

devices-vulnerable-to-cve

  • Title: Devices Vulnerable To CVE X
  • Description: Rank vulnerable devices by site criticality for a CVE.
Parameter Type Required Description
cve string true CVE 
SELECT device_id, plant_id, criticality, firmware_version
  FROM view_scada_device_vulnerabilities
 WHERE cve = :cve
 ORDER BY criticality DESC, device_id ASC

sessions-over-24h-on-safety-plcs

  • Title: Every Session Over 24h On Safety PLCs
  • Description: Return stale authenticated sessions targeting safety PLC assets.
Parameter Type Required Description
window_start string true Window Start 
SELECT session_id, engineer_id, device_id, open_hours
  FROM view_scada_stale_sessions
 WHERE observed_at >= :window_start
   AND open_hours > 24
 ORDER BY open_hours DESC

write-pattern-matching-triton-subgraph

  • Title: Every Triton-Pattern Write Sequence
  • Description: Show write activity matching the Triton / Trisis tradecraft fixture.
Parameter Type Required Description
pattern_id string true Pattern 
SELECT pattern_id, device_id, matched_at
  FROM view_scada_tradecraft_matches
 WHERE pattern_id = :pattern_id
 ORDER BY matched_at DESC

Report Templates

  • change-audit-pack.md.tmpl
  • compliance-evidence-bundle.md.tmpl
  • cve-exposure-memo.md.tmpl
  • post-incident-engineering-review.md.tmpl