Defend a running line.
Prove your decisions.
A controller write. An engineering workstation. An active maintenance window. Work through the evidence, test your controls, and document a response that accounts for the process.
Reconstruct what happened.
Inspect the normalized evidence and select events that need review. Approval-window context and source authorization are separate facts.
Asset ownership and trust boundaries
| Select | Event / UTC | Source → target | Activity | Window active | Approved write source |
|---|
Source roles come from the supplied asset register, not from port numbers. A record marked “review required” is not a confirmed attack.
Test the boundary, not just the port.
Eight test flows. First matching rule wins. Default deny. Preserve the required flows and block the unapproved paths.
Rule format and scenario requirements
Required: HMI-01 → PLC-01 read FC 3; ENG-02 → PLC-01 write FC 16; JUMP-01 → ENG-02 TCP 3389. All other listed flows must be denied.
Fields: action (allow/deny), source, destination, port, function_code. Omit a match field to make it a wildcard. Use * for any source or destination. Rules are ordered; a later deny does not override an earlier matching allow.
This is a conceptual application-aware policy model, not vendor firewall syntax. Function matching requires a supporting control; a port-only ACL cannot distinguish reads from writes on TCP 502.
Measure what your rule misses.
Tune detection logic against the same 18 records. Compare matches with the exercise’s reference review classifications.
Supported conditions and evaluation meaning
Use {"any": [{conditions}, {conditions}]}. Clauses are combined with OR; conditions inside each clause use AND. Supported: function_codes (integer array), approved_maintenance (boolean), write_source_approved (boolean), source (exact IP string).
approved_maintenance means a maintenance window is active in this teaching dataset. It does not establish that this source is approved to perform the observed action.
True positives match reference review events. False positives match other records. False negatives miss reference review events. Precision and recall apply only to this small case. They are not an estimate of real-world detection performance.
Authorize a session, not an entire vendor.
Test eight requests against a named identity, target scope, and session controls. This exercise uses a separate site-local clock.
Maintenance entitlement
The expected entitlement is Vendor-A → ENG-02 with every listed control. The window includes 14:00 and excludes 16:00. These switches simulate policy requirements; they do not change a real access system.
Make the operational decision explicit.
Evaluate vulnerability treatment, containment, and recovery gates. Record the rationale and residual uncertainty.
Synthetic details only. Saved in this browser. Export before clearing browser data.
Reference context
NIST SP 800-82 Rev. 3 ↗ · MITRE ATT&CK for ICS: Modify Parameter, T0836 ↗
The case uses original synthetic content. These references provide context and do not certify or endorse the exercises. Normal maintenance and unauthorized activity can share protocol functions; use source, approval, device and process evidence together.