Sub Use Case: Deep discovery and understanding of all assets in OT environments

[ShaunaV]

Definitions: 

1. Provide the top ICS equipment and summarize it by type 
2. Provide the top ICS equipment and summarize it by brand 
3. Provide a summary of top PLC models 
4. Provide a summary of all ICS nested devices summarized by type 
5. Provide a summary of all ICS nested devices summarized by brand 
6. Provide a summary of new ICS devices summarized by type 
7. Provide a summary of new ICS devices summarized by brand 
8. Provide a summary of all offline ICS devices summarized by type 
9. Provide a summary of all offline PLCs summarized by brand 
10. Provide a Table of all offline ICS assets 
11. Provide a summary of all ICS Assets which Information has changed in the last day 
12. Provide a summary of all Firmware version used 
13. Provide a summary of all Windows version used 
14. Provide the rate for ICS assets without identification 

  

Dashboards and Queries: 

1. Load the existing OT/ICS Asset Inventory Armis Value Pack from the library 
2. Create a dashlet to visualize the rate of ICS assets without identification 

      a. Dashlet Title: ICS Asset without Type Identification Rate 

      b. Dashlet Query: in:devices category:"Manufacturing Equipment" 

      c. Chart: Gauge 

      d. Summarize: Devices 

      e. By: Unknown Device Type 

        Note that ideally for this sub case, Brand, Model and Firmware version should be used, however these              parameters are not available in the By Value field of thePercentage Graph. 

      f. Gauge Settings: Green to Yellow - 5%, Yellow to Red - 20% (Armis suggestion) 

Sub Use Case: Discover and identify all assets in OT environments 

  

Definitions: 

1. Provide the rate for ICS assets without identification 

  

Dashboards and Queries: 

      a. Dashlet Title: ICS Asset without Type Identification Rate 

      b. Dashlet in:devices category:"Manufacturing Equipment" 

      c. Chart: Gauge 

      d. Summarize: Devices 

      e. By: Unknown Device Type 

      f. Gauge Settings: Green to Yellow - 5%, Yellow to Red - 20% (Armis suggestion) 

 

  

Sub Use Case: Asset Inventory Gap Analysis 

  

Definitions: 

1. Provide the rate for unmanaged ICS assets 

  

Dashboards and Queries: 

      a. Dashlet Title: Unmanaged ICS Assets - without boundary association 

      b. Dashlet Query: in:devices boundary:<EMPTY> 

      c. Chart: Gauge 

      d. Summarize: Devices 

      e. By: Category Manufacturing Devices 

      f. Gauge Settings: Green to Yellow - 10%, Yellow to Red - 20% (Armis suggestion) 

  

  

  

  

  

 

  

Sub Use Case: Managing assets according to owners, vendors and business context 

  

Definitions: 

1. Provide the rate for unmanaged ICS assets 

  

Dashboards and Queries: 

      a. Dashlet Title: Unmanaged ICS Assets - without site association 

      b. Dashlet Query: in:devices site:<EMPTY> 

      c. Chart: Gauge 

      d. Summarize: Devices 

      e. By: Category Manufacturing Devices 

      f. Gauge Settings: Green to Yellow - 10%, Yellow to Red - 20% (Armis suggestion)