Home
Reference Guides
Reference material for alerts and incidents, discovery and Smart Polling strategies, and Federal Information Processing Standards.
Alerts and Incidents
Reference guide for alerts and incidents.
Incidents
Incidents are a set of alerts that are related to each other. You can use them to streamline alerts analysis. The user interface (UI) lets you group alerts into incidents. You can toggle the view between Alerts or Incidents.
Learned behavior (virtual image)
Virtual image represents a set of information by which Guardian represents the monitored network. This includes for example node properties, links, protocols, function codes, variables, variable values. Such information is collected via learning, smart polling, or external contents, such as Asset Intelligence. When an incident of this category is raised, if the related event is not considered a malicious attack or an anomaly, it can be learned.
INCIDENT:VARIABLES-FLOW-ANOMALY
Variables Flow Anomaly

Reference Guides
Reference material for alerts and incidents, discovery and Smart Polling strategies, and Federal Information Processing Standards.
- Alerts and Incidents
  Reference guide for alerts and incidents.
  - Alerts
    A description of alerts in the Nozomi Networks software.
  - Incidents
    Incidents are a set of alerts that are related to each other. You can use them to streamline alerts analysis. The user interface (UI) lets you group alerts into incidents. You can toggle the view between Alerts or Incidents.
    - Built-in checks
      Built-in checks are based on specific signatures or hard-coded logics with reference to: known ICS threats (by signatures provided by Threat Intelligence), known malicious operations, system weaknesses, or protocol-compliant operations that can impact the network/ICS functionality. They might also leverage the Learning process to be more accurate.
    - Protocol validations
      An undesired protocol behavior has been detected. This can refer to a wrong single message, to a correct single message not supposed to be transmitted or transmitted at the wrong time (state machines violation) or to a malicious message sequence. Protocol specific error messages indicating misconfigurations also trigger alerts that fall into this category.
    - Learned behavior (virtual image)
      Virtual image represents a set of information by which Guardian represents the monitored network. This includes for example node properties, links, protocols, function codes, variables, variable values. Such information is collected via learning, smart polling, or external contents, such as Asset Intelligence. When an incident of this category is raised, if the related event is not considered a malicious attack or an anomaly, it can be learned.
      - INCIDENT:INTERNET-NAVIGATION
        Internet Navigation
      - INCIDENT:VARIABLES-FLOW-ANOMALY
        Variables Flow Anomaly
      - INCIDENT:VARIABLES-FLOW-ANOMALY:CONSUMER
        Variables Flow Anomaly on Consumer
      - INCIDENT:VARIABLES-FLOW-ANOMALY:PRODUCER
        Variables Flow Anomaly on Producer
      - INCIDENT:VARIABLES-NEW-VALUES
        New Values on Producer
      - INCIDENT:VARIABLES-NEW-VARS
        New Variables on Producer
      - INCIDENT:VARIABLES-NEW-VARS:CONSUMER
        New variables request from consumer
      - INCIDENT:VARIABLES-NEW-VARS:PRODUCER
        New variables transmission from producer
      - INCIDENT:VARIABLES-SCAN
        Variable Scan
    - Hybrid threat detection
      The Hybrid Category is assigned when alerts belonging to different categories as defined in the Alerts Dictionary are grouped within such one incident. The other categories are as defined in the Alerts Dictionary.
- Discovery
  Reference guide for discovery strategies.
- Smart Polling
  Reference guide for Smart Polling strategies.
- Federal Information Processing Standards
  Reference guide for Federal Information Processing Standards.
- N2OS Configuration Reference
  Reference guide for the current N2OS configuration settings (versioned publication).

INCIDENT:VARIABLES-FLOW-ANOMALY

Variables Flow Anomaly

Type ID

Cause

An updated time interval on a variable that used to be written or read with a regular interval has been detected.

Solution

Validate the set of events and learn them if legitimate, or treat them as anomalies.