T0878 Alarm Suppression — Detection Rules

Source-backed rule directory

No reviewed association in this snapshot.

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0728 Detection of Alarm Suppression

AN1861 Analytic 1861

Real-time monitoring of the alarm and process historian layer identifies an alarm status transitioning to suppressed, shelved, disabled, or acknowledged without a corresponding operator action recorded within a grace period, correlated with Industrial Control System (ICS) protocol write traffic to alarm configuration or threshold registers arriving in the same window from a source not in the approved engineering list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

AN2107 Analytic 2107

Real-time monitoring identifies a write to alarm configuration files on a Linux-based Supervisory Control and Data Acquisition (SCADA)/alarm server by a User Identifier (UID) that is not the alarm management service, or the alarm management service process receiving Application Programming Interface (API) calls that suppress alarm classes without a corresponding operator session. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

AN2108 Analytic 2108

Real-time monitoring identifies a write to alarm configuration files or database tables on an Human-Machine Interface (HMI)/alarm server by a process other than the recognized alarm management application, or an alarm-class-disable Application Programming Interface (API) call logged without a corresponding operator session ID in the HMI audit trail. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

AN2188 Analytic 2188

Real-time monitoring identifies a network-device ACL, filter, or rate-limit policy change that suppresses or blocks ICS alarm-notification traffic outside the approved network-change baseline. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.