Can You See What Your PLC Did?

A monitoring plan starts with a simple question.

If something changes on your controller, what evidence can you actually see?

Six Signal Families To Start From

These six give you a place to start:

• Successful login — shows when access was granted, if your controller or engineering system records it
• Failed login — can show attempts to access a controller, but you still need to know where the attempt came from
• Configuration or firmware change — helps you check whether controller settings or firmware changed
• Program change — can show that logic was modified or downloaded to a controller
• Program start or stop — helps you understand when a program changed its running state
• Controller restart — gives you a point in time to check against maintenance and process activity

We covered why these six carry most of the signal in an earlier piece: labshocksecurity.com/news/six-plc-events-cover-most-incident-signals

Find The Evidence Before You Build An Alert

Controllers do not all expose the same records.

Some evidence may come from an engineering tool, from network monitoring, or from another system entirely.

For each signal, ask:

• Where can I see it?
• Can I identify time and source?
• What does planned maintenance look like?
• What else would an analyst need to know?

A restart during planned work has one context. A restart during operation, with no known change behind it, needs more investigation.

One Event Starts A Question

Check what happened before and after.

Look at program changes, network activity and process state around the event, not only the event itself.

One event starts a question. The surrounding evidence is what answers it.

Practice This In Labshock

This is the kind of monitoring question I want people to practice in Labshock.

Pick one action. Find what you can actually observe. Be clear about what you still cannot prove.

Start with one PLC signal and trace its evidence.

Try It Yourself

• Pick one of the six signals and find where your own stack would actually record it.
• Read the six-signal framework this builds on: labshocksecurity.com/news/six-plc-events-cover-most-incident-signals
• Trace one signal end to end on a live controller: github.com/zakharb/labshock
• Compare what you found with other people doing the same exercise: discord.gg/bpmaQFfW76