OTLevel 2-1
OT Protocol Anomalies
0 alertsUnauthorized Modbus/CIP commands
The Engineering Foundation
At Data-IM, we understand that every layer of an industrial network; protocol, controller and logs reports what it was told to report, so a compromised network can lie about itself with nothing inside it able to prove otherwise.
Machine physics can't be told to lie: the model of the plant's own behavior becomes a second, independent witness, and where reported state and physical state disagree, you know something is true that the network is denying..
Operational Signals
Condition Monitoring Matrix
| Parameter | Current Value | Threshold | What It Means |
|---|---|---|---|
| RMS Velocity | 6.2 mm/s | Warning: 7.0 / Critical: 10.0 | Overall mechanical health |
| Peak Velocity | 8.9 mm/s | — | Maximum instantaneous movement |
| RMS High-Freq Acceleration | 2.1 g | Warning: 3.0 | Bearing defect detection |
| Kurtosis | 3.1 | Baseline: 3.0 | Impulse detection (spikes) |
| Crest Factor | 4.8 | Baseline: 3.5 | Impact severity indicator |
Signal Analysis
RMS trend +12% over 14d with intermittent bearing-frequency impulses
RMS (mm/s)—
Kurtosis—
Crest Factor—
Average Plant Health—
Maintenance Readiness—
Predictive Maintenance Queue
Compressor C791% confidence
RUL 17 daysBearing freq. spike at BPFI
Schedule bearing replacement; order parts
Crusher Motor A378% confidence
RUL 24 daysVibration trend +12% over 14d
Inspect coupling alignment; lubricate
Pump D285% confidence
RUL 36 daysSlight cavitation signature
Monitor suction pressure; check impeller
Conveyor E572% confidence
RUL 42 daysBelt misalignment detected
Adjust tensioners; schedule alignment
NETWORK ARCHITECTURE (PURDUE MODEL COMPLIANCE)
IT
OT
Level 4/5Enterprise and Business Networks
FirewallWeb ServerDNS ServerMail ServerEnterprise DesktopsSOCSIEM
Level 3.5IT/OT DMZ
FirewallPatch Server (DI)Historian Mirror (DI)Jump Server Host (DI)Data-IM Security Management Server
Level 3Operations Systems
FirewallWorkstation (DI)Historian (DI)I/O Server (DI)
Level 2Supervisory Control
FirewallHMI (DI)SCADA (DI)Jump Server Remote (DI)
Level 1Process Control
PLCsRTUsDSC ControllersSIS
Level 0Physical Process
SensorsActuators
Symbol Key(DI) = Data-IM Sentinel Agent
SECURITY MONITORING INDICATORS
ZONESECURITY METRICSTATUSWHAT IT TRACKS
OTLevel 1-0
Asset Discovery Delta
+2 new devicesUnknown sensors appearing on network
DMZLevel 3.5
Segmentation Breach
ClearCross-zone traffic violations
DMZLevel 3.5
Remote Access Sessions
1 activeTime-limited, MFA-secured vendor access
OTLevel 1-0
Firmware Integrity
VerifiedPLC/sensor firmware hash mismatch detection
DATA INTEGRITY FEATURES
Edge validation: Sensor data signed at source with hardware security module (HSM)Read-only historian: Monitoring system cannot write back to controllers (prevents manipulation)Audit trail: Every dashboard query logged with user attribution and timestampAir-gapped backup: Critical alerts replicated to offline historian via data diodeEdge validation: Sensor data signed at source with hardware security module (HSM)Read-only historian: Monitoring system cannot write back to controllers (prevents manipulation)Audit trail: Every dashboard query logged with user attribution and timestampAir-gapped backup: Critical alerts replicated to offline historian via data diode