Home
Reference Guides
Additional reference guides.
Alerts and Incidents
Alerts
A description of alerts in the Nozomi Networks software.
Protocol validations
An undesired protocol behavior has been detected. This can refer to a wrong single message, to a correct single message not supposed to be transmitted or transmitted at the wrong time (state machines violation) or to a malicious message sequence. Protocol specific error messages indicating misconfigurations also trigger alerts that fall into this category.

Reference Guides
Additional reference guides.
- Alerts and Incidents
  - Alerts
    A description of alerts in the Nozomi Networks software.
    - Built-in checks
      Built-in checks are based on specific signatures or hard-coded logics with reference to: known ICS threats (by signatures provided by Threat Intelligence), known malicious operations, system weaknesses, or protocol-compliant operations that can impact the network/ICS functionality. They might also leverage the Learning process to be more accurate.
    - Custom checks
      These are checks set in place by the user. Typically the nature of an event related to a custom check cannot generally be referred to a problem per se, if not contextualized to the specific network and installation.
    - Protocol validations
      An undesired protocol behavior has been detected. This can refer to a wrong single message, to a correct single message not supposed to be transmitted or transmitted at the wrong time (state machines violation) or to a malicious message sequence. Protocol specific error messages indicating misconfigurations also trigger alerts that fall into this category.
      - NET:RST-FROM-PRODUCER
        Link RST request by Producer
      - PROC:SYNC-ASKED-AGAIN
        Producer sync request by Consumer
      - PROC:WRONG-TIME
        Process time issue
      - SIGN:ARP-FLOOD
        ARP flood
      - SIGN:ARP:DUP
        Duplicated IP
      - SIGN:DDOS
        DDOS attack
      - SIGN:DHCP-OPERATION
        DHCP operation
      - SIGN:ILLEGAL-PARAMETERS
        Illegal parameters request
      - SIGN:INVALID-IP
        Invalid IP
      - SIGN:MAC-FLOOD
        Flood of MAC addresses
      - SIGN:MALFORMED-TRAFFIC
        Malformed traffic
      - SIGN:MALICIOUS-PROTOCOL
        Malicious protocol
      - SIGN:MULTIPLE-ACCESS-DENIED
        Multiple Access Denied events
      - SIGN:MULTIPLE-OT_DEVICE-RESERVATIONS
        Multiple OT device reservations
      - SIGN:MULTIPLE-UNSUCCESSFUL-LOGINS
        Multiple unsuccessful logins
      - SIGN:NET-MALFORMED
        Malformed Network/Transport layer
      - SIGN:NETWORK-SCAN
        Network Scan
      - SIGN:PROC:MISSING-VAR
        Missing variable request
      - SIGN:PROC:UNKNOWN-RTU
        Missing or unknown device
      - SIGN:PROTOCOL-ERROR
        Protocol error
      - SIGN:PROTOCOL-FLOOD
        Protocol-based flood
      - SIGN:PROTOCOL-INJECTION
        Protocol packet injection
      - SIGN:TCP-FLOOD
        TCP flood
      - SIGN:UDP-FLOOD
        UDP flood
      - SIGN:UNSUPPORTED-FUNC
        Unsupported function request
    - Learned behavior (virtual image)
      Virtual image represents a set of information by which Guardian represents the monitored network. This includes for example node properties, links, protocols, function codes, variables, variable values. Such information is collected via learning, smart polling, or external contents, such as Asset Intelligence. Alerts in this group represent deviations from expected behaviors, according to the learned or fed information. When an alert of this category is raised, if the related event is not considered a malicious attack or an anomaly, it can be learned.
  - Incidents
    Incidents are a set of alerts that are related to each other. You can use them to streamline alerts analysis. The user interface (UI) lets you group alerts into incidents. You can toggle the view between Alerts or Incidents.
- Discovery
- Smart Polling
- Federal Information Processing Standards

Protocol validations

An undesired protocol behavior has been detected. This can refer to a wrong single message, to a correct single message not supposed to be transmitted or transmitted at the wrong time (state machines violation) or to a malicious message sequence. Protocol specific error messages indicating misconfigurations also trigger alerts that fall into this category.