<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-ics-network-monitoring
description: >-
  Deploy continuous network monitoring for ICS/OT environments using Zeek, Suricata,
  and SPAN/TAP infrastructure to provide deep packet inspection of industrial protocols,
  flow analysis, and real-time alerting for SCADA network security.
domain: cybersecurity
subdomain: ot-ics-security
tags:
  - network-monitoring
  - ics
  - zeek
  - suricata
  - span
  - tap
  - deep-packet-inspection
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T0830", "T0884"]
  nist-csf: ["DE.CM-1", "DE.CM-7", "DE.AE-1"]
  iec-62443: ["SR 6.1", "SR 6.2"]
  uuid: a1b2c3d4-1011-4000-a011-000000000011
---

# Implementing ICS Network Monitoring

## Overview

OT network monitoring is the primary detection capability for ICS environments.
Unlike IT networks, OT traffic is predictable and deterministic — making anomaly
detection highly effective. Deploying Zeek and Suricata on network TAPs provides
protocol-aware visibility into Modbus, DNP3, S7comm, OPC-UA, and EtherNet/IP traffic
without impacting control system operations.

Mode: `[MODE: BLUE]` for deployment and tuning; `[MODE: ARCHITECT]` for sensor placement.

## Prerequisites

| Requirement | Details |
|---|---|
| Network TAP or SPAN port on each OT VLAN/zone boundary | Required |
| Dedicated monitoring server (8+ cores, 32GB+ RAM, 1TB+ storage) | Required |
| Zeek 6.0+ compiled with ICS protocol support | Required |
| Suricata 7.0+ with ET Open ICS rulesets | Required |
| SIEM for log aggregation (Splunk, Elastic, etc.) | Required |

## Key Concepts

### Sensor Placement Strategy

```
Purdue Model Monitoring Points:
Level 3.5 DMZ    ← TAP here (IT/OT boundary — highest priority)
Level 3 → 2      ← TAP here (Historian/HMI to control network)
Level 2 → 1      ← TAP here (HMI to PLC communications)
Level 1 → 0      ← SPAN if possible (PLC to field devices)

Priority order:
1. IT/OT DMZ boundary (catches all cross-zone traffic)
2. Control network backbone (PLC/HMI communications)
3. Remote access entry point (VPN/jump host)
4. Historian/MES connectivity
```

### Zeek ICS Deployment

```bash
# Install Zeek with ICS protocol support
# zeek.org/download or package manager

# Configure Zeek for ICS monitoring
cat > /etc/zeek/local.zeek << 'EOF'
@load base/protocols/conn
@load base/protocols/dns
@load base/protocols/http
@load base/protocols/ssl
@load policy/protocols/modbus
@load policy/protocols/dnp3
@load policy/protocols/mqtt
# Custom ICS scripts
@load ./ics_baseline.zeek
@load ./ics_alerts.zeek
EOF

# Configure monitored interface
cat > /etc/zeek/node.cfg << 'EOF'
[zeek]
type=standalone
host=localhost
interface=eth1
EOF

# Start Zeek
zeekctl deploy
zeekctl status

# Verify ICS protocol parsing
tail -f /var/log/zeek/current/modbus.log
tail -f /var/log/zeek/current/dnp3.log
tail -f /var/log/zeek/current/conn.log
```

### Suricata ICS Configuration

```yaml
# /etc/suricata/suricata.yaml — ICS additions

app-layer:
  protocols:
    modbus:
      enabled: yes
      detection-ports:
        dp: 502
    dnp3:
      enabled: yes
      detection-ports:
        dp: 20000
    enip:
      enabled: yes
      detection-ports:
        dp: 44818

# ICS-specific rule sources
# suricata-update enable-source et/open
# suricata-update enable-source oisf/trafficid
```

```bash
# Deploy ICS-specific Suricata rules
suricata-update list-sources | grep -i ics
suricata-update enable-source et/open

# Add custom ICS rules
cat >> /etc/suricata/rules/ics-custom.rules << 'EOF'
# Alert on any new source talking Modbus to PLC network
alert tcp !$ICS_KNOWN_MASTERS any -> $PLC_NET 502 ( \
  msg:"ICS-MON - New Modbus Source Detected"; \
  flow:established,to_server; \
  sid:4007001; rev:1;)

# Alert on cross-zone ICS protocol traffic
alert tcp $IT_NET any -> $OT_NET 502 ( \
  msg:"ICS-MON - Modbus from IT Zone to OT Zone"; \
  flow:established,to_server; \
  sid:4007002; rev:1;)

# Alert on ICS traffic to internet
alert tcp $OT_NET any -> !$RFC1918 any ( \
  msg:"ICS-MON - OT Device Internet Connection"; \
  flow:established,to_server; \
  sid:4007003; rev:1;)
EOF

# Validate and deploy
suricata -T -c /etc/suricata/suricata.yaml
systemctl restart suricata
```

### Log Integration

```bash
# Forward Zeek logs to SIEM via filebeat
cat > /etc/filebeat/modules.d/zeek.yml << 'EOF'
- module: zeek
  connection:
    enabled: true
    var.paths: ["/var/log/zeek/current/conn.log"]
  modbus:
    enabled: true
    var.paths: ["/var/log/zeek/current/modbus.log"]
  dnp3:
    enabled: true
    var.paths: ["/var/log/zeek/current/dnp3.log"]
EOF

# Forward Suricata EVE JSON
cat > /etc/filebeat/modules.d/suricata.yml << 'EOF'
- module: suricata
  eve:
    enabled: true
    var.paths: ["/var/log/suricata/eve.json"]
EOF

filebeat test config && systemctl restart filebeat
```

## Workflow

### Step 1: Deploy TAPs and Sensors

```bash
# Install network TAP at zone boundary
# Configure SPAN port as backup
# Deploy monitoring server with Zeek + Suricata
```

### Step 2: Baseline and Tune

```bash
# Run monitoring for 7+ days before alerting
# Generate baseline communication profiles
# Tune rules to reduce false positives below 10/day
```

### Step 3: Operationalize

```bash
# Integrate with SIEM and SOC workflows
# Create OT-specific dashboards and alert escalation
# Schedule monthly rule review and update
```

## Verification

- [ ] Network TAPs deployed at all critical zone boundaries
- [ ] Zeek parsing ICS protocols (modbus.log, dnp3.log populated)
- [ ] Suricata ICS rules loaded and generating alerts
- [ ] Logs forwarded to SIEM with correct field mapping
- [ ] Baseline communication profile established
- [ ] Cross-zone traffic alerts operational
- [ ] Storage retention meets compliance requirements (90+ days)

## Detection Opportunities

- New communication pairs on ICS protocols → unauthorized device or lateral movement
- Cross-zone traffic (IT→OT) → firewall bypass or misconfiguration
- OT devices connecting to internet → malware C2 or exfiltration
- Protocol anomalies (malformed packets, unusual function codes) → attack tooling
- Traffic volume spikes on ICS ports → DoS or bulk data exfiltration

```yaml
title: Ics Network Monitoring Detection
id: ac830863-ce11-4e75-a52c-78d6ab38fd3c
status: experimental
description: Detects suspicious activity related to implementing ics network monitoring techniques in ot ics security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*implementing*ics*"
  condition: selection
level: medium
tags:
  - attack.t0830
  - attack.t0884
  - attack.lateral_movement
falsepositives:
  - Industrial control system maintenance by authorized engineering staff
```

## References

- Zeek Documentation: ICS Protocol Analyzers
- Suricata Documentation: ICS Protocol Support
- NIST SP 800-82 Rev 3 §6.3: OT Network Monitoring
- SANS ICS515: ICS Visibility, Detection, and Response
