table4

Author: tarTech23

articles/defender-for-iot/organizations/alert-engine-messages.md

@@ -94,7 +94,7 @@ The policy engine alerts table contains the **Aggregated** item to indicate that
 | **FTP Login Failed** | A failed sign-in attempt was detected from a source device to a destination server. This alert might be the result of human error, but could also indicate a malicious attempt to compromise the server or data on it. | Medium | Authentication | **Tactics:** <br> - Lateral Movement <br> - Command And Control <br><br> **Techniques:** <br> - T0812: Default Credentials <br> - T0869: Standard Application Layer Protocol | Not learnable | Not aggregated |
 | **Function Code Raised Unauthorized Exception [*](#ot-alerts-turned-off-by-default)** | A source device (secondary) returned an exception to a destination device (primary). | Medium | Command Failures | **Tactics:** <br> - Inhibit Response Function <br><br> **Techniques:** <br> - T0835: Manipulate I/O Image | Learnable| Aggregated |
 | **GOOSE Message Type Settings** | Message (identified by protocol ID) settings were changed on a source device. | Low | Unauthorized Communication Behavior | **Tactics:** <br> - Impair Process Control <br><br> **Techniques:** <br> - T0836: Modify Parameter | Learnable | Aggregated |
-| **Honeywell Firmware Version Changed** | Firmware was updated on a source device. This might be authorized activity, for example a planned maintenance procedure. | Medium | Firmware Change | **Tactics:** <br> - Inhibit Response Function <br> - Persistence <br><br> **Techniques:** <br> - T0857: System Firmware | Learnable|  |
+| **Honeywell Firmware Version Changed** | Firmware was updated on a source device. This might be authorized activity, for example a planned maintenance procedure. | Medium | Firmware Change | **Tactics:** <br> - Inhibit Response Function <br> - Persistence <br><br> **Techniques:** <br> - T0857: System Firmware | Learnable| Not aggregated |
 | **Illegal HTTP Communication [*](#ot-alerts-turned-off-by-default)** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Medium | Abnormal HTTP Communication Behavior | **Tactics:** <br> - Discovery <br><br> **Techniques:** <br> - T0846: Remote System Discovery | Learnable | Not aggregated  |
 | **Internet Access Detected** | A source device defined as part of your network is communicating with Internet addresses. The source isn't authorized to communicate with Internet addresses. | Medium | Internet Access | **Tactics:** <br> - Initial Access <br><br> **Techniques:** <br> - T0883: Internet Accessible Device | Learnable | Not aggregated |
 | **Mitsubishi Firmware Version Changed** | Firmware was updated on a source device. This might be authorized activity, for example a planned maintenance procedure. | Medium | Firmware Change | **Tactics:** <br> - Inhibit Response Function <br> - Persistence <br><br> **Techniques:** <br> - T0857: System Firmware | Learnable | Not aggregated |
@@ -108,7 +108,7 @@ The policy engine alerts table contains the **Aggregated** item to indicate that
 | **New Activity Detected - EtherNet/IP Protocol Command** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Medium | Unauthorized Communication Behavior | **Tactics:** <br> - Inhibit Response Function <br><br> **Techniques:** <br> - T0836: Modify Parameter | Learnable | Aggregated |
 | **New Activity Detected - GSM Message Code** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Medium | Unauthorized Communication Behavior | **Tactics:** <br> - CommandAndControl <br><br> **Techniques:** <br> - T0869: Standard Application Layer Protocol | Learnable | Aggregated |
 | **New Activity Detected - LonTalk Command Codes** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Medium | Unauthorized Communication Behavior | **Tactics:** <br> - Collection <br> - Impair Process Control <br><br> **Techniques:** <br> - T0861 - Point & Tag Identification <br> - T0855: Unauthorized Command Message | Learnable | Aggregated |
-| **New Port Discovery** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Low | Discovery | **Tactics:** <br> - Lateral Movement <br><br> **Techniques:** <br> - T0867: Lateral Tool Transfer | Learnable|  |
+| **New Port Discovery** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Low | Discovery | **Tactics:** <br> - Lateral Movement <br><br> **Techniques:** <br> - T0867: Lateral Tool Transfer | Learnable| Not aggregated |
 | **New Activity Detected - LonTalk Network Variable** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Medium | Unauthorized Communication Behavior | **Tactics:** <br> - Impair Process Control <br><br> **Techniques:** <br> - T0855: Unauthorized Command Message | Learnable| Aggregated |
 | **New Activity Detected - Ovation Data Request** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Medium | Unauthorized Communication Behavior | **Tactics:** <br> - Collection <br> - Discovery <br><br> **Techniques:** <br> - T0801: Monitor Process State <br> - T0888: Remote System Information Discovery | Learnable | Aggregated |
 | **New Activity Detected - Read/Write Command (AMS Index Group)** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Medium | Configuration Changes | **Tactics:** <br> - Impair Process Control <br> - Inhibit Response Function <br><br> **Techniques:** <br> - T0855: Unauthorized Command Message <br> - T0836: Modify Parameter | Learnable | Aggregated |
@@ -124,9 +124,9 @@ The policy engine alerts table contains the **Aggregated** item to indicate that
 | **New Asset Detected** | A new source device was detected on the network but isn't authorized. <br><br>This alert applies to devices discovered in OT subnets. New devices discovered in IT subnets don't trigger an alert.| Medium | Discovery | **Tactics:** <br> - Discovery <br><br> **Techniques:** <br> - T0842: Network Sniffing | Learnable| Not aggregated |
 | **New LLDP Device Configuration** | A new source device was detected on the network but isn't authorized. | Medium | Configuration Changes | **Tactics:** <br> - Discovery <br><br> **Techniques:** <br> - T0842: Network Sniffing | Learnable| Not aggregated |
 | **Omron FINS Unauthorized Command** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Medium | Unauthorized Communication Behavior | **Tactics:** <br> - Impair Process Control <br><br> **Techniques:** <br> - T0855: Unauthorized Command Message <br> - T0836: Modify Parameter | Learnable | Aggregated |
-| **S7 Plus PLC Firmware Changed** | Firmware was updated on a source device. This might be authorized activity, for example a planned maintenance procedure. | Medium | Firmware Change | **Tactics:** <br> - Inhibit Response Function <br> - Persistence <br><br> **Techniques:** <br> - T0857: System Firmware | Learnable |  |
+| **S7 Plus PLC Firmware Changed** | Firmware was updated on a source device. This might be authorized activity, for example a planned maintenance procedure. | Medium | Firmware Change | **Tactics:** <br> - Inhibit Response Function <br> - Persistence <br><br> **Techniques:** <br> - T0857: System Firmware | Learnable | Not aggregated |
 | **Sampled Values Message Type Settings** | Message (identified by protocol ID) settings were changed on a source device. | Low | Unauthorized Communication Behavior | **Tactics:** <br> - Impair Process Control <br><br> **Techniques:** <br> - T0836: Modify Parameter | Not learnable | Aggregated |
-| **Suspicion of Illegal Integrity Scan [*](#ot-alerts-turned-off-by-default)** | A scan was detected on a DNP3 source device (outstation). This scan wasn't authorized as learned traffic on your network. | Medium | Scan | **Tactics:** <br> - Discovery <br><br> **Techniques:** <br> - T0842: Network Sniffing | Learnable |  |
+| **Suspicion of Illegal Integrity Scan [*](#ot-alerts-turned-off-by-default)** | A scan was detected on a DNP3 source device (outstation). This scan wasn't authorized as learned traffic on your network. | Medium | Scan | **Tactics:** <br> - Discovery <br><br> **Techniques:** <br> - T0842: Network Sniffing | Learnable | Not aggregated |
 | **Toshiba Computer Link Unauthorized Command** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Low | Unauthorized Communication Behavior | **Tactics:** <br> - Impair Process Control <br> - Execution <br><br> **Techniques:** <br> - T0855: Unauthorized Command Message <br> - T0821: Modify Controller Tasking | Learnable | Aggregated |
 | **Unauthorized ABB Totalflow File Operation** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Medium | Unauthorized Communication Behavior | **Tactics:** <br> - Impair Process Control <br> - Execution <br><br> **Techniques:** <br> - T0855: Unauthorized Command Message <br> - T0821: Modify Controller Tasking | Not learnable | Aggregated |
 | **Unauthorized ABB Totalflow Register Operation** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Medium | Unauthorized Communication Behavior | **Tactics:** <br> - Impair Process Control <br> - Execution <br><br> **Techniques:** <br> - T0855: Unauthorized Command Message <br> - T0821: Modify Controller Tasking | Not learnable | Aggregated |
@@ -141,7 +141,7 @@ The policy engine alerts table contains the **Aggregated** item to indicate that
 | **Unauthorized GE SRTP File Access** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Medium | Unauthorized Communication Behavior | **Tactics:** <br> - Collection <br> - LateralMovement <br> - Persistence <br><br> **Techniques:** <br> - T0801: Monitor Process State <br> - T0859: Valid Accounts | Learnable | Aggregated |
 | **Unauthorized GE SRTP Protocol Command** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Medium | Unauthorized Communication Behavior | **Tactics:** <br> - Impair Process Control <br><br> **Techniques:** <br> - T0855: Unauthorized Command Message <br> - T0821: Modify Controller Tasking | Learnable | Aggregated |
 | **Unauthorized GE SRTP System Memory Operation** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Medium | Unauthorized Communication Behavior | **Tactics:** <br> - Discovery <br> - Impair Process Control <br><br> **Techniques:** <br> - T0846: Remote System Discovery <br> - T0855: Unauthorized Command Message | Learnable | Aggregated |
-| **Unauthorized HTTP Activity** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Medium | Abnormal HTTP Communication Behavior | **Tactics:** <br> - Initial Access <br> - Command And Control <br><br> **Techniques:** <br> - T0822: External Remote Services <br> - T0869: Standard Application Layer Protocol | Learnable |  |
+| **Unauthorized HTTP Activity** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Medium | Abnormal HTTP Communication Behavior | **Tactics:** <br> - Initial Access <br> - Command And Control <br><br> **Techniques:** <br> - T0822: External Remote Services <br> - T0869: Standard Application Layer Protocol | Learnable | Not aggregated |
 | **Unauthorized HTTP SOAP Action [*](#ot-alerts-turned-off-by-default)** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Medium | Abnormal HTTP Communication Behavior | **Tactics:** <br> - Command And Control <br> - Execution <br><br> **Techniques:** <br> - T0869: Standard Application Layer Protocol <br> - T0871: Execution through API | Learnable | Not aggregated |
 | **Unauthorized HTTP User Agent [*](#ot-alerts-turned-off-by-default)** | An unauthorized application was detected on a source device. The application isn't authorized as a learned application on your network. | Medium | Abnormal HTTP Communication Behavior | **Tactics:** <br> - Command And Control <br><br> **Techniques:** <br> - T0869: Standard Application Layer Protocol | Learnable | Not aggregated |
 | **Unauthorized Internet Connectivity Detected** | A source device defined as part of your network is communicating with Internet addresses. The source isn't authorized to communicate with Internet addresses. | High | Internet Access | **Tactics:** <br> - Initial Access <br><br> **Techniques:** <br> - T0883: Internet Accessible Device | Learnable | Not aggregated |