historian-tampering-detectionlisted

## When to Use - Auditing historian data integrity after a suspected compromise. - Verifying that values in reports and dashboards came through the collector path. - Investigating gaps or backfilled data in a tag history. - Reviewing the approved writer list on the historian servers. ## Prerequisites - Historian platform: OSIsoft PI, Wonderware Historian, Honeywell PHD, or Ignition. - Database audit access: PI audit trail, Wonderware audit views, SQL Server audit logs, or PostgreSQL pgaudit. - Approved writer list: collector service accounts and their source hosts. - Baseline tag archive snapshot from before the review window. - Credentials: read-only database access on the historian SQL tier. - Authorization: historian owner sign-off. Query review is passive. - Upstream skills: `passive-ot-network-discovery` for the collector source list. ### Safety This skill is passive. Queries run read-only against the audit trail and archive. - Passive. Analyzes audit logs and archive data. Sends no packets to control devices. Safe to run during normal operations. ## Workflow 1. Collect the approved writer list. One row per tag group: tags, writer account, source host. Export from the collector configuration. 2. Collect the audit trail for the review window. PI: `piarchmanager` audit trail. Wonderware: audit views. SQL Server: `sys.fn_get_audit_file`. PostgreSQL: pgaudit logs. The bundled `historian_audit_queries.sql` file has the working queries per platform. 3. Run the out-of-p