# Passive OT monitoring and anomaly review

Avoid premature conclusions from a new flow or quiet sensor. Interpret observations through coverage, maintenance, time and process context.

Original AI-assisted SecNet educational content. Fictional local examples; not a standards provider publication, endorsement or compliance evidence. Page exercises do not create account progress.

Sources checked: 2026-10-21

## The sensor-visible world

An online sensor does not establish visibility across all OT traffic. Mirror location, directions, capture loss, time source and retention limit coverage. Harbor separates observed segments from unobserved areas. Capture loss means an unseen operation cannot simply be declared absent. Sensor installation and data transport also need site-specific review. This exercise captures no traffic and configures no sensor; it questions coverage of supplied synthetic observations. Keep coverage records aligned with the detection result revision so later reviewers know which claims the available records can actually support.

## A new flow is not always an attack

A first-seen connection in a fictional record may reflect maintenance, backup activity, shift changes or misidentification. First seen depends on sensor history; it does not mean first ever. Compare maintenance plans, asset-owner context and approved-flow drafts. Do not accept a maintenance explanation without its ticket and time scope either. Record claims, observations and alternative explanations separately. Correct classification in a model establishes neither malicious activity on an actual device nor authority for automated response. The exercise supports a defensible question for the responsible site team.

## Protocol and process context

A protocol label does not establish that an operation is legitimate. Similar communication can have different meanings across process and maintenance states. Monitoring teams consult authorized process specialists where needed; a general IT analyst should not assume physical consequences alone. Record timestamps, source identity and collection conditions. Missing raw values constrain interpretation. This package contains no protocol parser or actual setpoints, only logical connections with purpose, direction and review reference. The exercise remains executable without becoming a production-control tool or giving learners unsupported operational instructions.

## Do not infer security from silence

No alert does not establish that a rule works correctly or that the plant has no incident. Review sensor coverage, intended detection behavior, retention window and authorized representative-test evidence together. Harbor distinguishes a quiet but poorly covered view from a documented view. Success is not merely a low alert count; it includes verifiable coverage and review quality. Reports state open gaps and the next needed record. Generating real test traffic or changing process behavior is outside the exercise, which uses only local synthetic evidence and produces no operational clearance.

## Working sequence

1. State sensor coverage and time window.
2. Record the observation with its original reference.
3. Compare maintenance and process-owner context.
4. Explain loss, clock and retention gaps.
5. Identify additional evidence and its owner.

## 1. Online sensor

Online status is not proof of segment coverage or lossless capture. Do not generalize observations across the plant without time, segment and capture-loss context.

This code is a local policy model; it does not replace actual equipment, process or safety assessment.

### Weak implementation
```js
s => s.sensorOnline === true
```

### Corrected implementation
```js
s => s.sensorOnline === true &&
  s.segmentsKnown === true &&
  s.captureLossReviewed === true &&
  s.timeKnown === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "sensorOnline": true,
        "segmentsKnown": true,
        "captureLossReviewed": true,
        "timeKnown": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-segmentsKnown",
      "input": {
        "sensorOnline": true,
        "segmentsKnown": false,
        "captureLossReviewed": true,
        "timeKnown": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-captureLossReviewed",
      "input": {
        "sensorOnline": true,
        "segmentsKnown": true,
        "captureLossReviewed": false,
        "timeKnown": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "sensorOnline": true,
        "segmentsKnown": true,
        "captureLossReviewed": true,
        "timeKnown": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-segmentsKnown",
      "input": {
        "sensorOnline": true,
        "segmentsKnown": false,
        "captureLossReviewed": true,
        "timeKnown": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-captureLossReviewed",
      "input": {
        "sensorOnline": true,
        "segmentsKnown": true,
        "captureLossReviewed": false,
        "timeKnown": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 2. Interpret the new flow

A new flow is an observation. Preserve its record and compare maintenance and owner context before concluding either malicious or legitimate activity.

This code is a local policy model; it does not replace actual equipment, process or safety assessment.

### Weak implementation
```js
s => s.newFlowObserved === true
```

### Corrected implementation
```js
s => s.newFlowObserved === true &&
  s.maintenanceCompared === true &&
  s.assetOwnerConsulted === true &&
  s.recordPreserved === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "newFlowObserved": true,
        "maintenanceCompared": true,
        "assetOwnerConsulted": true,
        "recordPreserved": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-maintenanceCompared",
      "input": {
        "newFlowObserved": true,
        "maintenanceCompared": false,
        "assetOwnerConsulted": true,
        "recordPreserved": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-assetOwnerConsulted",
      "input": {
        "newFlowObserved": true,
        "maintenanceCompared": true,
        "assetOwnerConsulted": false,
        "recordPreserved": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "newFlowObserved": true,
        "maintenanceCompared": true,
        "assetOwnerConsulted": true,
        "recordPreserved": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-maintenanceCompared",
      "input": {
        "newFlowObserved": true,
        "maintenanceCompared": false,
        "assetOwnerConsulted": true,
        "recordPreserved": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-assetOwnerConsulted",
      "input": {
        "newFlowObserved": true,
        "maintenanceCompared": true,
        "assetOwnerConsulted": false,
        "recordPreserved": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 3. No alert means clean?

Silence supplies no assurance without coverage and detection validation. Missing retention or representative detection tests leave an evidence gap, not a clean-plant verdict.

This code is a local policy model; it does not replace actual equipment, process or safety assessment.

### Weak implementation
```js
s => s.noAlert === true
```

### Corrected implementation
```js
s => s.noAlert === true &&
  s.coverageKnown === true &&
  s.retentionCovers === true &&
  s.detectionTested === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "noAlert": true,
        "coverageKnown": true,
        "retentionCovers": true,
        "detectionTested": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-coverageKnown",
      "input": {
        "noAlert": true,
        "coverageKnown": false,
        "retentionCovers": true,
        "detectionTested": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-detectionTested",
      "input": {
        "noAlert": true,
        "coverageKnown": true,
        "retentionCovers": true,
        "detectionTested": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "noAlert": true,
        "coverageKnown": true,
        "retentionCovers": true,
        "detectionTested": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-coverageKnown",
      "input": {
        "noAlert": true,
        "coverageKnown": false,
        "retentionCovers": true,
        "detectionTested": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-detectionTested",
      "input": {
        "noAlert": true,
        "coverageKnown": true,
        "retentionCovers": true,
        "detectionTested": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## Exit evidence

- Coverage/time/loss/retention matrix.
- Observation, alternative-explanation and missing-evidence record.

## References

- [NIST SP 800-82 Rev.3 · Final September 2023](https://csrc.nist.gov/pubs/sp/800/82/r3/final)
- [NCSC and partners · Maintaining a definitive view of OT architecture · October 2025](https://www.cyber.gov.au/sites/default/files/2025-10/ncsc-creating-and-maintaining-a-definitive-view-of-your-operational-technology-architecture.pdf)