A wastewater historian host writes ten times its normal volume to disk, but no known malware hash is present. What should the civic SOC do?
Select an answer to reveal the explanation.
Short Explanation
Ten times the usual writes on a historian is a bursting pipe even if nobody printed a malware wanted poster. Volume can be the finding. Waiting for a hash is how a plant keeps writing junk to disk.
Full Explanation
Outlier detection on civic OT assets does not require an indicator-of-compromise hit to be actionable. When a wastewater historian host writes ten times its normal volume to disk and no known malware hash is present, the civic SOC should treat the volume spike as a behavior outlier, escalate it, and scope related processes, users, and destinations in Splunk before deciding on containment. Behavior-first hunting matters for municipal plants because destructive or fraudulent activity can shred historian integrity long before ISAC lists publish a hash.
Closing the case because threat-intel lists are empty confuses "no known hash" with "no problem" and leaves OT integrity unexplained on a plant-critical host. Waiting for a C2 domain match before reviewing historian writes delays investigation of a clear volume anomaly that may be destructive or fraudulent even without outbound C2. Deleting the historian index so write volume cannot be measured destroys the evidence the hunt needs and harms wastewater visibility for every future incident.
Exam caveat: OT and ICS-adjacent hosts in municipal environments are high-impact outliers—disk and process volume deviations warrant escalation independent of ISAC hash hits, and empty intel is not a close criterion. Operational check: compare the historian's current write volume to its prior baseline across the same hours, list processes and accounts driving the spike, preserve the telemetry, open an investigation ticket, and only then consider containment—never close solely for empty threat lists or delete the index to hide the metric.