safety-instrumented-system-anomaly-detectionlisted

## When to Use - Monitoring SIS controllers for bypass or override manipulation. - Hunting for trip setpoint modification on safety controllers. - Investigating sensor disagreement between SIS and BPCS measurements. - Reviewing SIS audit trails during an incident or a periodic safety review. ## Prerequisites - SIS platform inventory: Triconex, HIMA, Yokogawa ProSafe, Honeywell Safety Manager, Emerson DeltaV SIS. One row per controller: platform, model, IP, engineering protocol and port. - Suricata 7.x on the span covering the SIS network segment. - SIS audit trail access: Triconex TriStation event log, HIMA audit, ProSafe event journal, Safety Manager log, DeltaV SIS event log. - Trip setpoint and bypass register baseline from the safety engineer. - Approved proof test schedule. - Credentials: read-only SIS event log access. Engineering access is not required and must not be requested. - Authorization: safety engineer sign-off. SIS traffic analysis is passive. Any live interaction with a SIS controller requires the safety engineer and change control together. - Upstream skills: `passive-ot-network-discovery` for the SIS segment span validation. ### Safety This skill is passive by default. Active steps are gated in the Workflow section. - Passive. Analyzes SIS audit logs and span traffic. Safe to run during normal operations. ## Workflow 1. Validate the span on the SIS segment: `tshark -i <iface> -c 10 -Y "tcp.port == 5001 or tcp.port == 1233 or tcp.port == 2114"`