Real-time monitoring identifies a Windows ICS asset initiating MQTT/AMQP/DDS communications to a broker/service not approved for the asset role, from a process not associated with authorized vendor or telemetry software. Require both a communication-matrix violation and destination/process/protocol corroboration; suppress approved brokers, telemetry collectors, vendor applications, and maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3; process-to-broker connection |
| Network Traffic Content (DC0085) | NSM:Content | MQTT/AMQP/DDS protocol identification, broker/topic/client metadata when visible |
| Network Traffic Flow (DC0078) | NSM:Flow | Client/broker connection metadata and periodicity |
| Field | Description |
|---|---|
| ApprovedBrokers | Authorized broker/service destinations |
| AuthorizedICSApplications | Processes/services permitted to publish/subscribe |
| ApprovedTopics | Expected topics/queues/domains where observable |
| ApprovedCommunicationMatrix | Allowed source-to-broker relationships |
| ExpectedReportingInterval | Expected telemetry/reporting cadence as corroboration |
Real-time monitoring identifies a Linux ICS service or process initiating MQTT/AMQP/DDS communications outside its approved broker/client relationship or from an unauthorized runtime/tool. Require communication-matrix violation plus process/destination/protocol corroboration; suppress approved telemetry, historian, gateway, vendor, and maintenance activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | linux:osquery | socket_events to broker/service, where deployed |
| Network Traffic Content (DC0085) | NSM:Content | MQTT/AMQP/DDS protocol and message metadata when visible |
| Network Traffic Flow (DC0078) | NSM:Flow | Client/broker flow metadata |
| Field | Description |
|---|---|
| ApprovedBrokers | Authorized brokers/services |
| AuthorizedICSApplications | Approved client processes/services |
| ApprovedTopics | Expected topics/queues where observable |
| ApprovedCommunicationMatrix | Allowed client/broker relationships |
| ExpectedReportingInterval | Expected telemetry cadence |
Real-time monitoring identifies MQTT/AMQP/DDS sessions crossing an unexpected zone boundary, connecting an ICS client to an unapproved broker/service, or using client/topic/message behavior inconsistent with the documented pub/sub architecture. Require topology/identity/topic/destination violation; periodicity alone is not sufficient.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | Protocol identification; MQTT CONNECT/SUBSCRIBE/PUBLISH, AMQP/DDS metadata where parsable |
| Network Traffic Flow (DC0078) | NSM:Flow | Source/destination/port/session metadata |
| Network Connection Creation (DC0082) | NetworkDevice:Syslog | Permitted/denied connection creation where network devices record it |
| Field | Description |
|---|---|
| ApprovedBrokers | Broker IP/FQDN/service inventory |
| ApprovedClientIDs | Expected MQTT/AMQP client identities where observable |
| ApprovedTopics | Expected publish/subscribe topic namespaces |
| ApprovedCommunicationMatrix | Allowed zone/client/broker relationships |
| TLSProfile | Expected encrypted/unencrypted protocol use and certificate identities |
Real-time monitoring identifies an embedded OT/IoT device establishing MQTT/AMQP/DDS communication with a broker/service outside its device-specific profile, using an unexpected client identity/topic, or crossing an unauthorized zone boundary. Fixed-function device behavior should be compared to the documented broker/topic/destination profile rather than a generic anomaly threshold.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | Pub/sub protocol, client ID, topic/queue and message metadata when observable |
| Network Traffic Flow (DC0078) | NSM:Flow | Device-to-broker flow metadata |
| Network Connection Creation (DC0082) | NSM:Connections | New device-to-broker relationship outside documented profile |
| Field | Description |
|---|---|
| DeviceBrokerProfile | Expected broker(s) for each device/model/site |
| ApprovedClientIDs | Expected client identity/certificate where observable |
| ApprovedTopics | Expected publish/subscribe topic namespace |
| ApprovedCommunicationMatrix | Expected telemetry cadence used only as corroboration |
| ExpectedReportingInterval | Expected telemetry cadence used only as corroboration |