Home
Reference Guides
Reference material for alerts and incidents, discovery and Smart Polling strategies, and Federal Information Processing Standards.
Alerts and Incidents
Reference guide for alerts and incidents.
Alerts
A description of alerts in the Nozomi Networks software.
Built-in checks
Built-in checks are based on specific signatures or hard-coded logics with reference to: known ICS threats (by signatures provided by Threat Intelligence), known malicious operations, system weaknesses, or protocol-compliant operations that can impact the network/ICS functionality. They might also leverage the Learning process to be more accurate.
SIGN:OT_DEVICE-STOP
OT device stop request

Reference Guides
Reference material for alerts and incidents, discovery and Smart Polling strategies, and Federal Information Processing Standards.
- Alerts and Incidents
  Reference guide for alerts and incidents.
  - Alerts
    A description of alerts in the Nozomi Networks software.
    - Built-in checks
      Built-in checks are based on specific signatures or hard-coded logics with reference to: known ICS threats (by signatures provided by Threat Intelligence), known malicious operations, system weaknesses, or protocol-compliant operations that can impact the network/ICS functionality. They might also leverage the Learning process to be more accurate.
      - SIGN:BOOT-SECURITY-ERROR
        Boot security error
      - SIGN:CLEARTEXT-PASSWORD
        Cleartext password
      - SIGN:CONFIGURATION-CHANGE
        Configuration change
      - SIGN:CPE:CHANGE
        CPE change
      - SIGN:DEV-STATE-CHANGE
        Device state change
      - SIGN:DUALUSE-DETECTED
        DUALUSE detection
      - SIGN:DUALUSE-DOMAIN
        DUALUSE domain
      - SIGN:DUALUSE-IP
        DUALUSE IP
      - SIGN:DUALUSE-URL
        DUALUSE URL
      - SIGN:FIRMWARE-TRANSFER
        Firmware transfer
      - SIGN:FIRMWARE:CHANGE
        Firmware change
      - SIGN:INFORMATION-GATHERING
        Information gathering
      - SIGN:LOGIN
        Login to Device
      - SIGN:MALICIOUS-DOMAIN
        Malicious domain
      - SIGN:MALICIOUS-HID
        Malicious USB device
      - SIGN:MALICIOUS-IP
        Bad ip reputation
      - SIGN:MALICIOUS-URL
        Malicious URL
      - SIGN:MALWARE-DETECTED
        Malware detection
      - SIGN:MITM
        MITM attack
      - SIGN:OT_DEVICE-REBOOT
        OT device reboot request
      - SIGN:OT_DEVICE-START
        OT device start request
      - SIGN:OT_DEVICE-STOP
        OT device stop request
      - SIGN:OUTBOUND-CONNECTIONS
        High rate of outbound connections
      - SIGN:PACKET-RULE
        Packet rule match
      - SIGN:PASSWORD:WEAK
        Weak password
      - SIGN:PROGRAM:CHANGE
        Program change
      - SIGN:PROGRAM:TRANSFER
        Program transfer
      - SIGN:PUA-DETECTED
        PUA detection
      - SIGN:PUA-DOMAIN
        PUA domain
      - SIGN:PUA-IP
        PUA IP
      - SIGN:PUA-URL
        PUA URL
      - SIGN:SD-CARD
        SD card operation
      - SIGN:SIGMA-RULE
        Sigma rule match
      - SIGN:SUSP-TIME
        Suspicious time value
      - SIGN:USB-DEVICE
        New USB device connected
      - SIGN:USB-FILE-TRANSFER
        USB file transfer
      - SIGN:WEAK-ENCRYPTION
        Weak encryption
      - SIGN:WIFI:CONNECTION-ATTEMPT
        Repeated Connection Attempt
      - SIGN:WIFI:DEAUTH:ATTEMPT
        Deauth Attack Attempt
      - SIGN:WIFI:DEAUTH:SUCCESS
        Deauth Attack
      - SIGN:WIFI:ESPNOW-ATTACK
        ESP-NOW attack
      - SIGN:WIFI:LORA-ANOMALY
        Lora Anomaly
      - SIGN:WIFI:REGION-MISMATCH
        Region mismatch on Japan country
      - SIGN:WIFI:SSID-XSS-INJECTION
        SSID XSS injection attempt
      - SIGN:WIRELESS:BLE-MALFORMED-CONNECTION
        Bluetooth Malformed Connection Request
      - SIGN:WIRELESS:INJECTION
        Suspected wireless packet injection
      - SIGN:WIRELESS:ODID-VIOLATION-RULES
        OpenDrone ID packet violating rules
    - Custom checks
      These are checks set in place by the user. Typically the nature of an event related to a custom check cannot generally be referred to a problem per se, if not contextualized to the specific network and installation.
    - Protocol validations
      An undesired protocol behavior has been detected. This can refer to a wrong single message, to a correct single message not supposed to be transmitted or transmitted at the wrong time (state machines violation) or to a malicious message sequence. Protocol specific error messages indicating misconfigurations also trigger alerts that fall into this category.
    - Learned behavior (virtual image)
      Virtual image represents a set of information by which Guardian represents the monitored network. This includes for example node properties, links, protocols, function codes, variables, variable values. Such information is collected via learning, smart polling, or external contents, such as Asset Intelligence. Alerts in this group represent deviations from expected behaviors, according to the learned or fed information. When an alert of this category is raised, if the related event is not considered a malicious attack or an anomaly, it can be learned.
  - Incidents
    Incidents are a set of alerts that are related to each other. You can use them to streamline alerts analysis. The user interface (UI) lets you group alerts into incidents. You can toggle the view between Alerts or Incidents.
- Discovery
  Reference guide for discovery strategies.
- Smart Polling
  Reference guide for Smart Polling strategies.
- Federal Information Processing Standards
  Reference guide for Federal Information Processing Standards.
- N2OS Configuration Reference
  Reference guide for the current N2OS configuration settings (versioned publication).

SIGN:OT_DEVICE-STOP

OT device stop request

Type ID

SIGN:OT_DEVICE-STOP

Security profile

Alerts of this type are visible in the following security profiles:

HIGH
PARANOID

Risk

The base risk for this alert is 9.

Cause

An OT device program has been requested to stop (e.g. by the engineering workstation). This may be something due to Engineering operations, for instance the maintenance of the program itself or a system updates. However, it may indicate suspicious activity from an attacker trying to manipulate the device execution.

Solution

Investigate on the network configuration and the possible presence of malicious actors.

Product versions

Guardian 18.0.0

Trace

Alerts of this type are expected to generate traces.

Deduplication key

Attribute DESTINATION_NODE_ID
Attribute TYPE_ID
Attribute TRIGGER_ID