FireSight OT OT remote access

Detect: threat detection on Cloud Connectors

Detect is new in FireSight OT 0.4.0 (in beta), as a licensed add-on. An 8 GB Cloud Connector listens to the plant network, recognises threats and devices, and sends its findings to the Cloud Hub. The Hub groups them into incidents. Each incident shows who had remote access to that site at the time, with one-click responses.

What you need

• An 8 GB Cloud Connector (e.g. CC-5 8 GB / 16 GB) with 0.4.0 software and image (the image includes the Suricata engine). For a unit flashed with an older image: sudo apt install -t bookworm-backports suricata ieee-data && sudo systemctl mask suricata.
• The Detect licence for the Hub: one add-on licence per Cloud Hub, a separate file next to its main licence, covering all its Cloud Connectors whatever their number (install it under License; ask for it on the portal, see FireSight OT licenses). It's on during the evaluation. When it expires, Detect and rule pack updates keep working for 30 days, then stop.
• A copy of the traffic. The Cloud Connector only sees traffic to and from itself unless one of its ports is wired to:
  • the mirror (SPAN) port of a managed switch, set to copy the machine ports or the uplink to the PLCs; or
  • a passive network tap in the cable you want to watch, where the switch is unmanaged.

The listening port never sends anything, so it can't disturb the plant: when Detect starts, the Cloud Connector takes it away from NetworkManager, removes any address, and turns off ARP and IPv6 on it, so it doesn't even answer or announce itself. Never put the Cloud Connector in line (between the switch and the machines): if it restarted, the link would drop.

Two ways to wire it:

The site can refuse Detect on the device: threat_detection=off in firesight.txt, or untick it on the local setup page.

Turning it on

Detect → Cloud Connectors → Turn on: choose the listening port and, optionally, the plant networks (used to tell inside from outside; default: all private ranges). The status shows the engine, rules, packets seen and dropped. If no traffic arrives within a few minutes, check the mirror session on the switch.

For the first 24 hours (Rules → learning time) Detect learns which devices are normal; after that, a new device on the network opens an incident.

Incidents

Alerts of the same rule between the same two addresses make one incident until it's closed. Each shows:

• severity (high, medium, low), the rule, source and destination, the protocol, and the matching resources;
• remote sessions through that Cloud Connector from 15 minutes before it started: who, to what, when, and whether the session was to the machine in the alert;
• the evidence (latest raw alerts) and the history of what was done.

Responses: End session, Suspend user (disabled, signed out, every session ended), End all sessions there, and Lock down the site (every session ends and nobody, including the full-network VPN, can connect through that Cloud Connector until someone lifts it on Detect → Cloud Connectors). Then mark it investigating, resolved or a false positive, with notes.

A rule that fires on normal traffic can be muted for one machine, one site, or everywhere (administrators). Muted rules are listed, and can be unmuted, under Rules.

Devices

Every device seen (from ARP and traffic): address, VLAN, MAC and maker, the resources at that address, the protocols it uses, and who it talks to.

Rules

The Hub builds one rule set once a day and sends it through the tunnels; each Cloud Connector tests it with Suricata before using it (rules its Suricata can't load are skipped). Sources:

• FireSight OT built-in rules (always): Modbus listen-only / restart / UMAS / writes from outside, DNP3 restarts and stop, CIP reset/stop, Siemens S7 stop / download / PI service / upload, industrial protocols from outside the plant, cleartext FTP logins.
• FireSight OT rule pack: our rules, updated between software releases. Licensed Hubs fetch it daily from license.firesightsystems.com; a Hub without internet access can upload the pack file under Rules. The Hub accepts a pack only with FireSight Systems' signature, and its rules replace the built-in versions.
• Emerging Threats Open (free) or Emerging Threats Pro with your own code.
• abuse.ch SSL Blacklist.
• Uploaded rules: a .rules file or .tar.gz (for Hubs without internet access, or your own).

The Hub downloads from license.firesightsystems.com, rules.emergingthreats.net, rules.emergingthreatspro.com and sslbl.abuse.ch; allow them outbound if you use those sources. With expired licences, rule updates stop.

Where findings go

• Alerts → New alert → Threat detected: email at once (high only, medium and up, or all), at most 20 an hour per alert, with who had remote access at the time.
• Webhooks, syslog and the OT security platform tiles: the threats category (threat_detected, device_new); CEF severity 9 / 6 / 3, cs6 the rule ID.

The Hub keeps findings (incidents, devices, conversations, raw alerts) for 90 days by default, never packets, in /var/lib/fsot-hub/detect. Cloud Connectors on mobile data (on demand) open the tunnel at once for medium and high threats; devices and conversations follow the next time the tunnel is open.

Switch settings

More detail, with an example: Switch settings for Cloud Connectors.

The Cloud Connector is an end device, not a switch: it never bridges ports or VLANs and never sends spanning-tree frames (BPDUs), so it doesn't take part in spanning tree. On the switch:

• The Cloud Connector's machine port: an edge port (PortFast) with BPDU Guard on. Root Guard isn't needed (that's for ports towards other switches). With VLANs, make it a trunk carrying only the VLANs the Cloud Connector uses, tagged, and the base machine network untagged (native).
• The mirror port (Detect): a mirror (SPAN) destination; most switches then ignore anything arriving on it. The listening port sends nothing anyway.