OT Security Context Cheat Sheet

OT monitoring becomes more useful when technical events are connected to asset and process context.

We group this context into six areas.

When

• Timestamp
• Duration
• First seen
• Last seen
• Maintenance window

Where

• Site / facility
• Zone / segment
• Network / conduit
• Physical location
• Environment

Asset

• Asset name
• Asset type
• Vendor / model
• Asset role
• Criticality

Event

• Protocol
• Action / command
• Tag / register / object
• Old value
• New value

Process State

• Process state
• Expected behavior
• Equipment affected
• Production state
• Safety relevance

Detection

• Detection source
• Rule / analytic
• Severity
• Confidence
• Logs or packet evidence

What Changed Versus What It Means

A value change alone tells you what changed.

Process state tells you what that change means.

Connecting technical events with asset, operational and detection context gives defenders information they can validate and use, rather than a field and a number.

Try It Yourself

• Pick one alert your stack fires today and check how many of these six areas it actually carries.
• For the ones missing, find where that context lives — engineering workstation, asset inventory, SCADA, or nowhere yet.
• Practice this on a real controller: labshocksecurity.com/news/can-you-see-what-your-plc-did
• Start free: github.com/zakharb/labshock · discord.gg/bpmaQFfW76