# Can network monitoring show who changed a PLC setpoint?

It can show which computer sent the write and when, which is usually enough to find the person. Most industrial protocols carry no user name, so the network only knows the source address. Linking that address to a person is done with the HMI or SCADA audit trail, the engineering software's log and the shift roster. To make this possible later, give every engineering station its own fixed address, require named logins on HMIs and SCADA, and keep their logs as long as your quality records. From the Pro plan, NetSenX reads writes from passive capture on a SPAN or TAP port and, when the writer is not allowed to write, raises an alert with the source host, the controller, the function code and the time. It does not record the value written and it never identifies a person: it watches devices and connections, not people.

FAQ: [OT and IoT](https://netsenx.com/en/faq/ot) · https://netsenx.com/en/faq/can-network-monitoring-show-who-changed-a-plc-setpoint

## Read next

- https://netsenx.com/en/ot-network-monitoring
- https://netsenx.com/en/compare

## Related questions

- [Does NetSenX record the values written to our controllers?](https://netsenx.com/en/faq/does-netsenx-record-the-values-written-to-controllers)
- [Can OT alerts help a quality or safety investigation?](https://netsenx.com/en/faq/can-ot-write-events-support-a-quality-or-safety-investigation)
- [Does NetSenX raise a separate anomaly alert for each industrial protocol?](https://netsenx.com/en/faq/does-netsenx-raise-a-separate-alert-for-each-industrial-protocol)
- [Can NetSenX block a dangerous command to a PLC?](https://netsenx.com/en/faq/can-netsenx-block-a-dangerous-command-to-a-plc)
- [Does NetSenX read PROFINET, OPC UA or IEC 60870-5-104?](https://netsenx.com/en/faq/does-netsenx-read-profinet-or-opc-ua)