Can network monitoring show who changed a PLC setpoint?

It can show which computer sent the write and when, which is usually enough to find the person. Most industrial protocols carry no user name, so the network only knows the source address. Linking that address to a person is done with the HMI or SCADA audit trail, the engineering software's log and the shift roster. To make this possible later, give every engineering station its own fixed address, require named logins on HMIs and SCADA, and keep their logs as long as your quality records. From the Pro plan, NetSenX reads writes from passive capture on a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port and, when the writer is not allowed to write, raises an alert with the source host, the controller, the function code and the time. It does not record the value written and it never identifies a person: it watches devices and connections, not people.

← All 50 questions on OT and IoTAll topics