Detections
Analytics

Device Status Query Detected (High)

high Tenable OT Security Plugin ID 503184

Synopsis

A device status query has been detected on the OT asset.

Description

A status query has been sent to the device, which might indicate a reconnaissance activity.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

1) Check whether the query was executed as part of the normal operation and that its source is approved to perform it.

2) If this was not part of routine operation, check the source asset of the event to determine if it was compromised.

Plugin Details

Severity: High

ID: 503184

Version: 1.1

Type: remote

Published: 5/5/2025

Updated: 5/5/2025

Supported Sensors: Tenable OT Security