Automated mapping of OT devices to the Equipment Model

  • Release version: Xanadu
  • Updated August 1, 2024
  • 2 minutes to read

    • Automate mapping of OT devices to the production process.​

    When OT managers experience vulnerabilities or need to manage workflow involving OT devices, the context of how the OT device connects to the production process it automates is critical to prioritizing work. ​ ​Automatic mapping of OT devices to ISA equipment model entities enables the view of device-to-process relationships​.
    Note:
    Only one subnet range per site is supported. Two different sites can have the same subnet; for example, 192.168.101.0/24. But multiple subnets of the same range are not supported for the same site. It is recommended that you use manual mapping in this scenario.

    Key benefits

    • Upload and store OT subnets from authoritative sources (such as NetDB or Firewalls) as records in a ServiceNow ​ instance.
    • Automate assignment of OT devices to ISA entity using IP addresses and OT subnet
    • Minimize issues with reuse of private IP address ranges across multiple sites​

    Industrial networks use subnets to divide the private IP address space with a single subnet often aligned to a part of the production process, or the equipment model entity. For example: A canning line runs on a 192.168.101.0/24 network in which all the equipment was programmed by the integrator. The IPs used by the control systems, or OT devices, are often hard coded into the automation software used to run the line. If the subnet maps to the canning line in the Atlanta site, a manager can automatically map a detected PLC with IP 192.168.101.66 to the canning line.

    The mapping feature relates each subnet to an equipment model entity, enabling you to automatically map OT devices to the subnets associated with the equipment model entity based on the IP address that was reported upon import from an OT Certified integration or ServiceNow® Discovery for OT.​

    A system administrator can import OT subnet mapping records. An ISA administrator can automatically create mappings of subnets to equipment model entities through a scheduled job flow. An ISA Editor can manually create mappings of an individual OT device on-demand.

    Automated mapping feature personas

    The automated mapping feature is aimed at the following personas.
    Table 1. Personas for automated mapping
    Persona Description
    System Admin The System Administrator performs these tasks:
    • Imports data into the OT subnet to Equipment Model Entity Mapping table
    • Activates, schedules, or manually triggers the OT Subnet Mapping scheduled flow
    ISA Admin The ISA admin manually triggers the Map all OT devices UI action from the OT Subnet Mapping list view.
    ISA Editor The ISA editor performs these tasks:
    • Manually creates and updates OT subnet mapping entries for specific sites
    • Maps individual OT devices to an equipment model entity from an OT device record
    • Maps multiple OT devices to an equipment model entity from an OT subnet mapping record

    Plugins

    Enabling the mapping feature requires the following plugins:

    If the required plugins are installed, an ISA administrator can access the subnet mapping feature from the Industrial Process Manager application menu.