Skip to content
OT principles
ASD Essentials

Essentials for OT

DET-02 Cyber security event detection

two actionsAlso in ASD Essentials for enterprise IT

Watch OT network traffic so you can detect cyber security events in time. Capture and monitor traffic on both sides of every OT-connected buffer network (DMZ) boundary and between OT segments. Alert when control protocols cross segment boundaries where they are not expected.

Reviewed 18 October 2026 · Current to ASD's Essentials for OT, published 15 October 2026

The principle

Anomalous or unexpected events and behaviours for systems (infrastructure, operating systems, applications and data) are analysed in a timely manner to detect cyber security events.

ASD, Information Security Manual (ISM), Principle DET-02

The two actions

ASD's actions are quoted as published in Essentials for OT. ASD has not given them IDs, so they are numbered by position.

  1. Action 1 of 2

    Capture and monitor network traffic continuously on both sides of all OT-connected demilitarised zone boundaries.

    In plain English: Capture and monitor network traffic all the time. Do this on both sides of every OT-connected buffer network (DMZ) boundary.

    Domains
    Boundary services
    MITRE ATT&CK
    Port scanning
    Remote services

  2. Action 2 of 2

    Capture and monitor traffic at interfaces between segments within OT, using detection methods with a high signal-to-noise ratio, and alert on control protocols crossing segment boundaries where they are not expected.

    In plain English: Capture and monitor traffic where OT segments meet, using detection that raises few false alarms. Alert when control protocols cross segment boundaries where they are not expected.

    Domains
    Boundary services
    MITRE ATT&CK
    Port scanning
    Standard application layer protocol
    Remote system discovery

See all 34 principles in Essentials for OT, or read our OT guide.

Sources

The ASD publications this page quotes.

Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.

MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.

Everything else on this page is written by Control Stack.