Eastwater Facility
Water distribution control under active monitoring — baseline, Zeek, or Suricata.
Eastwater Facility is the primary lab for the Signalspire zone, modeling a water distribution control system with active network monitoring and SIEM integration.
The environment introduces a basic industrial water system where a single PLC manages flow, pressure, and water quality. A simple HMI interface provides process visibility and control.
Users are introduced to operational water infrastructure: starting and stopping processes, connecting to PLC systems via industrial protocols, and observing how sensor data is translated into control logic.
Eastwater Facility marks the first step into water treatment systems, where every drop is governed by automation logic.
The Eastwater Facility serves the outer districts of Signalspire, maintaining steady distribution through a modest but reliable control system.
Flowmaster Rathok oversees the hydraulic behavior of the system, observing how even small variations in pressure or demand propagate through the network.
In Eastwater, stability is not guaranteed by complexity, but by discipline — and the constant awareness that every change in flow has a cause upstream.
"Water never moves without reason. If the flow changes, something upstream has already decided it."
Monitoring variants
One plant. 3 ways to watch it.
The industrial process is identical in every variant — same PLC logic, same protocols, same topology. What changes is the detection and observability stack sitting on top of it, so you can compare what each one actually sees.
Eastwater Facility Baseline
FreeThe water distribution process on its own.
Eastwater Facility is the primary lab for the Signalspire zone, modeling a water distribution control system with active network monitoring and SIEM integration.
The environment introduces a basic industrial water system where a single PLC manages flow, pressure, and water quality. A simple HMI interface provides process visibility and control.
Users are introduced to operational water infrastructure: starting and stopping processes, connecting to PLC systems via industrial protocols, and observing how sensor data is translated into control logic.
Eastwater Facility marks the first step into water treatment systems, where every drop is governed by automation logic.
The Eastwater Facility serves the outer districts of Signalspire, maintaining steady distribution through a modest but reliable control system.
Flowmaster Rathok oversees the hydraulic behavior of the system, observing how even small variations in pressure or demand propagate through the network.
In Eastwater, stability is not guaranteed by complexity, but by discipline — and the constant awareness that every change in flow has a cause upstream.
Eastwater Facility Zeek
FreeNetwork security monitoring over the water process.
Eastwater Zeek adds network security monitoring to the water distribution environment, recording what happened on the wire rather than judging it.
Zeek parses the industrial sessions between SCADA and the PLC and writes them out as structured logs — conn.log for who talked to whom, modbus.log with the function, unit and PDU type of every request and response, and weird.log for protocol anomalies nobody wrote a rule for.
The lab is built around the gap that creates. A Zeek log line does not say a write was malicious; it says this source wrote to that register at that time. Deciding whether that is normal requires a baseline, and building one from live traffic is the exercise.
Most of what goes wrong in a water system is done with entirely valid commands.
Write Single Coil is not an exploit. The protocol is doing exactly what it was built to do, so a signature engine stays quiet — correctly.
What is left is the record: who, what, when. Eastwater Zeek exists so that record can be read against a process you already understand.
Eastwater Facility Suricata
FreeSignature-based intrusion detection over the water process.
Eastwater Suricata adds a signature-based intrusion detection engine to the water distribution environment, covering the half of detection that Zeek deliberately does not.
Suricata evaluates traffic against rules and alerts when one matches — strong on known bad, silent on anything nobody has characterised yet.
The lab starts from a detail that catches out most deployments: the Modbus and DNP3 application-layer parsers ship disabled in a stock configuration, and on Suricata 7 and later a rule using a disabled protocol keyword is rejected at load time rather than failing quietly. Users enable the parser, load industrial rules, operate the process, and confirm what fired.
A signature engine answers one question well: has somebody already seen and described this?
Run it beside Zeek on the same water process and the division of labour becomes obvious — one names the known, the other records the rest.
Neither is sufficient. Running both against traffic you generated yourself is how that stops being an opinion.