Home
Resources
Reference Guides
Additional reference guides with information on items such as Alerts and Incidents and Federal Information Processing Standards (FIPS).
Alerts and Incidents
Alerts
Alerts
A description of alerts in the Nozomi Networks software.
Custom checks
These are checks set in place by the user. Typically the nature of an event related to a custom check cannot generally be referred to a problem per se, if not contextualized to the specific network and installation.

Resources
- Release Notes
  Access the release notes for release-based products.
- N2OS Configuration
  The N2OS Configuration - Reference Guide.
- N2OS Software Development Kit
  The N2OS Software Development Kit (SDK).
- Integration Guides
  Integration guides to help you use applications that integrate with Nozomi Networks products.
- Reference Guides
  Additional reference guides with information on items such as Alerts and Incidents and Federal Information Processing Standards (FIPS).
  - Alerts and Incidents
    - Alerts
      - Alerts
        A description of alerts in the Nozomi Networks software.
        Protocol validations
        An undesired protocol behavior has been detected. This can refer to a wrong single message, to a correct single message not supposed to be transmitted or transmitted at the wrong time (state machines violation) or to a malicious message sequence. Protocol specific error messages indicating misconfigurations also trigger alerts that fall into this category.
        Virtual image
        Virtual image represents a set of information by which Guardian represents the monitored network. This includes for example node properties, links, protocols, function codes, variables, variable values. Such information is collected via learning, smart polling, or external contents, such as Asset Intelligence. Alerts in this group represent deviations from expected behaviors, according to the learned or fed information. When an alert of this category is raised, if the related event is not considered a malicious attack or an anomaly, it can be learned.
        Built-in checks
        Built-in checks are based on specific signatures or hard-coded logics with reference to: known ICS threats (by signatures provided by Threat Intelligence), known malicious operations, system weaknesses, or protocol-compliant operations that can impact the network/ICS functionality. They might also leverage the Learning process to be more accurate.
        Custom checks
        These are checks set in place by the user. Typically the nature of an event related to a custom check cannot generally be referred to a problem per se, if not contextualized to the specific network and installation.
    - Incidents
  - Federal Information Processing Standards
- Quick Start Guides
  Hardware Quick Start Guides.
- Security
  Stay up-to-date with the most recent information and solutions for all vulnerabilities that affect Nozomi Networks products.
- Print format documentation
  A list of all the technical documentation that is available in print format.
- Documentation archive
  Access previous versions of the technical documentation.

Custom checks

These are checks set in place by the user. Typically the nature of an event related to a custom check cannot generally be referred to a problem per se, if not contextualized to the specific network and installation.


Type ID	Name	Security Profile	Risk	Details	Product Versions	Trace
ASRT:FAILED	Assertion failed	LOW	0	An assertion has failed. Assertion dependent. Check out the elements making the assertion to fail.	Guardian 18.0.0	YES
GENERIC:EVENT	Generic Event	LOW	0	A generic event has been generated by the SDK. Event dependent. More details are available in the description of the event.	Guardian 20.0.5	YES
NET:INACTIVE-PROTOCOL	Inactive protocol	LOW	3	The link has been inactive for longer than the set threshold. Investigate whether that is the expected behavior or something prevents the link from working.	Guardian 18.0.0	YES
NET:LINK-RECONNECTION	Link reconnection	LOW	3	The link configured to be persistent has experienced a complete TCP reconnection. Investigate whether the reconnection is legitimate.	Guardian 18.0.0	YES
NET:TCP-SYN	TCP SYN	LOW	3	A connection attempt (TCP SYN) has been detected on a link. Investigate on the entity that has attempted to connect.	Guardian 18.0.0	YES
PROC:CRITICAL-STATE-OFF	Critical state off	LOW	1	The system has recovered from a user-defined critical process state. Investigate such critical state.	Guardian 18.0.0	YES
PROC:CRITICAL-STATE-ON	Critical state on	LOW	9	The system has entered in a user-defined critical process state. Investigate on the values and whether the process is at risk.	Guardian 18.0.0	YES
PROC:INVALID-VARIABLE-QUALITY	Invalid variable quality	LOW	3	A variable has showed a quality bit set for longer than the set threshold. Investigate on the protocol implementation and the process status.	Guardian 18.0.0	YES
PROC:NOT-ALLOWED-INVALID-VARIABLE	Not allowed variable quality	LOW	3	A variable has shown one or more specific quality bits the user set as not allowed. Investigate on the protocol implementation and the process status.	Guardian 18.0.0	YES
PROC:STALE-VARIABLE	Stale variable	LOW	3	A variable has not been read/written for longer than the set threshold. Investigate on the protocol implementation and the link and process status.	Guardian 18.0.0	YES