dnp3-anomaly-detectionlisted

## When to Use - Monitoring a DNP3 segment for unauthorized master or outstation behavior. - Hunting for outstation impersonation or unsolicited response injection. - Detecting cold restart or time sync manipulation on SCADA links. - Investigating operator reports of stale or frozen telemetry. ## Prerequisites - Suricata 7.x. Verify with `suricata --build-info`. The `dnp3:` keyword is native. - Zeek 5.x with the DNP3 analyzer. Verify with `zeek -NN dnp3`. - Baseline from `passive-ot-network-discovery`: master and outstation pair list, polling schedule, normal function code counts. - Site variables for the ruleset: `$DNP3_MASTERS`, `$DNP3_OUTSTATIONS`. - Python 3.10 or newer for the triage script. - Credentials: none for analysis. IDS reload rights for deployment. - Authorization: segment owner sign-off for rule deployment. Live test traffic is gated. - Upstream skills: `passive-ot-network-discovery` for the pair list and polling baseline. ### Safety This skill is passive by default. Active steps are gated in the Workflow section. - Passive. Authors rules and analyzes captures and IDS logs. Safe to run during normal operations. ## Workflow 1. Extract the authorized pairs and function code profile from the baseline: `tshark -r baseline.pcapng -Y "dnp3" -T fields -e ip.src -e ip.dst -e dnp3.func | sort | uniq -c > dnp3_profile.txt` Function codes appear as decimal values. 1 READ, 2 WRITE, 3 SELECT, 4 OPERATE, 5 DIRECT_OPERATE, 13 COLD_RESTART, 24 WRITE time sync cl