New device: 192.168.10.47 (Siemens), S7comm on 102, LLDP: “CPU 1214C”, first seen Monday 09:14.Versions and services read from traffic (SSH, HTTP, TLS, SMB, SNMP, ENIP identity, LLDP) → correlated offline with known CVEs, no active scanning.
Modbus write multiple registers from workstation 192.168.10.5 to PLC 192.168.10.21, Tuesday 02:37 — outside working hours.Modbus (write, diagnostics, identity), DNP3 (select, operate, direct operate, restart, stop), S7 (STOP, write, program download/upload, PI), IEC-104 (commands, reset), CIP (write, reset).
RDP connection from 10.0.0.12 (office network) to HMI 192.168.10.30; ICS → Internet: 192.168.10.21 to 185.x.x.x:443.Any new address in the process network, remote access from outside, ICS → Internet links, Telnet and clear-text protocols.
If mirroring stops or the port goes down, the sensor immediately reports that it no longer sees traffic. Absence of alerts is never mistaken for quiet.