Detections
Analytics

Abnormal Network Behavior Detected (High)

high Tenable OT Security Plugin ID 503196

Synopsis

An abnormal network behavior has been detected.

Description

Abnormal network behavior by unexpected assets can indicate reconnaissance of the network by a potential attacker.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

Check the source asset to determine whether it is expected to be generating this network traffic. If not, contact the source asset owner to check if any scans were initiated. If the network traffic isn't accounted for, consider isolating the source asset to decrease network exposure while you investigate further.

Plugin Details

Severity: High

ID: 503196

Version: 1.1

Type: remote

Published: 5/5/2025

Updated: 5/5/2025

Supported Sensors: Tenable OT Security