Monitor device alarms for program downloads, although not all devices produce such alarms.
Monitor for protocol functions related to program download or modification. Program downloads may be observable in ICS automation protocols and remote management protocols.
Consult asset management systems to understand expected program versions.
Monitor devices configuration logs which may contain alerts that indicate whether a program download has occurred. Devices may maintain application logs that indicate whether a full program download, online edit, or program append function has occurred.
| Data Component | Name | Channel |
|---|---|---|
| Device Alarm (DC0108) | Operational Databases | None |
| Network Traffic Content (DC0085) | Traffic | None |
| Asset Inventory (DC0110) | Asset | None |
| Application Log Content (DC0038) | Application Log | None |