<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Auditing Safety Instrumented Systems — API & Tool Reference

> Quick reference for tools, commands, and APIs used in auditing-safety-instrumented-systems.

## Tools

### `nmap`

Network connectivity testing for SIS isolation verification.

**Usage:**
```bash
nmap -Pn -p 1502,502,102 <sis_ip> --reason
```

**Key Flags:**
  - `-Pn`: skip host discovery
  - `--reason`: show port state reason
  - Expected result: all ports filtered (isolated)

---

### `tshark`

Capture and analyze TriStation protocol traffic (TRITON indicator).

**Usage:**
```bash
tshark -i <iface> -f "udp port 1502" -w <output.pcap>
```

**Key Filters:**
  - `udp.port == 1502`: TriStation protocol (Schneider Triconex)
  - Any traffic on this port outside maintenance = CRITICAL alert

---

### `yara`

Scan SIS engineering workstations for TRITON artifacts.

**Usage:**
```bash
yara -r triton_rules.yar /path/to/scan/
```

---

### `find`

Filesystem search for known TRITON file artifacts.

**Usage:**
```bash
find / -name "trilog*" -o -name "inject.bin" 2>/dev/null
```

---

## Integration Notes

- SIS networks should have zero IP connectivity to BPCS or IT networks
- TriStation protocol (UDP/1502) traffic is the primary TRITON network indicator
- Physical key switch verification requires on-site inspection
- Data diodes (not firewalls) recommended for SIS status export

## See Also

- Parent skill: [OT/ICS Security](../../../SKILL.md)
- IEC 61511: Safety Instrumented Systems for the Process Industry
- ISA TR84.00.09: Cybersecurity Related to the SIS
