A wastewater historian host writes ten times its normal volume to disk, but no known malware hash is present. What should the civic SOC do?
Select an answer to reveal the explanation.
Short Explanation
Ten times the usual writes on a historian is a bursting pipe even if nobody printed a malware wanted poster. Volume can be the finding. Waiting for a hash is how a plant keeps writing junk to disk.
Full Explanation
Outlier detection on civic OT assets does not require an IoC hit. A historian with an order-of-magnitude write spike is a behavioral volume outlier worth escalation and scoping in Splunk. Closing for empty intel, waiting for C2, or deleting telemetry removes the very evidence the hunt needs.