Monitoring OT devices equipment
Kaspersky Industrial CyberSecurity for Networks can monitor equipment on specialized OT devices, such as PLCs, that automate a process. Equipment monitoring is supported for the following types of devices:
- Siemens SIMATIC S7-300, S7-400
- Schneider Electric Modicon: M580, M340
The application receives information about OT device equipment via Active Poll connectors. After adding connectors to the application, you can use these to get information when running the following types of security audit jobs:
- Configuration control jobs. We recommend this job type if you want to use Archive versions or Compare with benchmark configuration processing for information about equipment connected to OT devices. To obtain equipment information, select the PLC configuration type when adding or modifying a configuration control job.
- Active polling jobs. We recommend this job type if you want to receive further information available from the provided active polling methods along with equipment information. To obtain information about OT device equipment, select Industrial device extended configuration, and then select the appropriate methods of getting advanced configuration depending on selected devices when adding or editing an active polling job.
After scanning an OT device as part of a configuration control or active polling job, the application updates the equipment information for the device. The information for which automatic update is disabled upon adding a device or changing the device information is not updated. The capability to disable automatic update is not available for some equipment details.
Monitoring OT device equipment helps the application to get information listed in the table below.
Information obtained when monitoring OT device equipment
Information type |
Displayed on the tab in the device details area |
Ability to disable automatic update |
|---|---|---|
Graphical layout of modules in slots |
Equipment |
|
Details of each module |
Equipment, Configurations |
|
Advanced device information in the form of key entries and key values, such as memory status and device security settings |
Equipment, Configurations |
|
Details of the PLC project and project blocks |
Configurations |
|
Hardware vendor |
General |
|
Hardware model |
General |
|
Hardware version |
General |
|
Software version |
General |
|
In addition to the information listed above, the content of logs stored in the Central Processing Unit (CPU) module can be downloaded to the application. If the device has more than one CPU module connected to it, the logs specific to the module that the Kaspersky Industrial CyberSecurity for Networks connector connected to are downloaded. You can download a file with device logs by using the link on the Equipment tab in the device details area.
Page top