Quarterly Compliance & Evidence Package
Executive Summary
During Q1 2026, the Kyntic appliance at SITE-WTP-01 maintained continuous passive monitoring of all OT network traffic with 99.7% uptime coverage. The appliance captured and analyzed 3,381,482 industrial protocol connections across Modbus/TCP, DNP3, and EtherNet/IP.
Eight (8) alerts were generated during the quarter. Three required a real-time SMS to the operator (two CRITICAL IT-to-OT boundary crossings and one HIGH new-device detection -- a replacement variable frequency drive installed during a pump upgrade); all three were correlated to scheduled maintenance and dispositioned within 30 minutes. The remaining five (MEDIUM and LOW) were captured for evidence only -- no human action was needed, so no SMS was sent. All eight are detailed below.
No unauthorized access, malware indicators, or anomalous command-and-control traffic was detected. The device inventory remained stable with one authorized addition. All log data is stored with SHA-256 integrity verification under S3 Object Lock with a 7-year retention policy.
Thirteen weekly "all-quiet" status texts were delivered to the operator on schedule (every Monday at 08:00 local) confirming appliance health between alerts.
Monitoring Coverage
Gap: 7 hours on February 14 to 15, 2026 (planned facility power outage for main electrical panel upgrade, maintenance ticket EP-2026-011). The appliance resumed monitoring automatically on power restoration. Zeek logs queued locally during downtime were shipped upon reconnection.
Network Connection Summary
The following table summarizes all connections observed on the OT network during the reporting period, grouped by industrial protocol.
| Protocol | Port | Connections | Avg Duration | Total Bytes |
|---|---|---|---|---|
| Modbus/TCP | 502 | 2,147,832 | 3.1 ms | 18.4 GB |
| EtherNet/IP | 44818 | 892,441 | 8.4 ms | 12.7 GB |
| DNP3 | 20000 | 341,209 | 11.2 ms | 4.1 GB |
Top Communication Pairs
| Source | Destination | Protocol | Connections |
|---|---|---|---|
| 10.10.50.20 (HMI-Primary) | 10.10.50.10 (PLC-PS1) | Modbus | 847,291 |
| 10.10.50.20 (HMI-Primary) | 10.10.50.11 (PLC-PS2) | Modbus | 812,104 |
| 10.10.50.20 (HMI-Primary) | 10.10.50.12 (PLC-Chem) | Modbus | 488,437 |
| 10.10.50.40 (SCADA-RTU) | 10.10.50.20 (HMI-Primary) | DNP3 | 341,209 |
| 10.10.50.20 (HMI-Primary) | 10.10.50.10 (PLC-PS1) | EtherNet/IP | 421,887 |
| 10.10.50.20 (HMI-Primary) | 10.10.50.11 (PLC-PS2) | EtherNet/IP | 398,214 |
Alert Summary
Eight alerts were generated during Q1 2026. Three were texted to the operator in real time (CRITICAL and HIGH only -- where a human action was required). The remaining five were logged in this evidence report without paging the operator. All eight were investigated and dispositioned within 24 hours.
Alert Detail Log
Zeek Connection Log Samples
Below is a representative sample of raw Zeek JSON log entries as captured by the appliance. Every connection on the monitored network is logged in this format and shipped to encrypted, immutable cloud storage every 30 minutes.
conn.log: Normal Modbus HMI to PLC polling
{"ts":1768209263.847,"uid":"CYLk4x1a2bRc4d","id.orig_h":"10.10.50.20","id.orig_p":49152,"id.resp_h":"10.10.50.10","id.resp_p":502,"proto":"tcp","service":"modbus","duration":0.002847,"orig_bytes":12,"resp_bytes":9,"conn_state":"SF"}
{"ts":1768209265.912,"uid":"CYLk4x5e6fPg8h","id.orig_h":"10.10.50.20","id.orig_p":49153,"id.resp_h":"10.10.50.10","id.resp_p":502,"proto":"tcp","service":"modbus","duration":0.003102,"orig_bytes":12,"resp_bytes":9,"conn_state":"SF"}
modbus.log: Function code detail
{"ts":1768209263.847,"uid":"CYLk4x1a2bRc4d","id.orig_h":"10.10.50.20","id.orig_p":49152,"id.resp_h":"10.10.50.10","id.resp_p":502,"function_code":3}
// FC 6 = Write Single Register (operator setpoint change via HMI, normal operation)
{"ts":1768214401.223,"uid":"CYLk4xQr9s0tUv","id.orig_h":"10.10.50.20","id.orig_p":49201,"id.resp_h":"10.10.50.12","id.resp_p":502,"function_code":6}
conn.log: DNP3 SCADA communication
{"ts":1768209264.789,"uid":"CYLk4x9iWj1k2l","id.orig_h":"10.10.50.40","id.orig_p":52847,"id.resp_h":"10.10.50.20","id.resp_p":20000,"proto":"tcp","service":"dnp3","duration":0.011234,"orig_bytes":48,"resp_bytes":124,"conn_state":"SF"}
conn.log: IT to OT boundary crossing (triggered KYNTIC-001)
{"ts":1768293263.441,"uid":"CHTp2z3mNn4o5p","id.orig_h":"192.168.1.105","id.orig_p":49847,"id.resp_h":"10.10.50.10","id.resp_p":502,"proto":"tcp","service":"modbus","duration":2821.447,"orig_bytes":8472,"resp_bytes":14208,"conn_state":"SF"}
OT Device Inventory
All IP addresses observed communicating on the OT subnet during Q1 2026. Devices are compared against the baseline inventory established during the initial 14-day learning period.
| IP Address | Device Type | Manufacturer | Model | Role | Status |
|---|---|---|---|---|---|
| 10.10.50.10 | PLC | Allen-Bradley | CompactLogix 5380 | Pump Station 1 Controller | Baseline |
| 10.10.50.11 | PLC | Allen-Bradley | CompactLogix 5380 | Pump Station 2 Controller | Baseline |
| 10.10.50.12 | PLC | Siemens | S7-1200 | Chemical Dosing Controller | Baseline |
| 10.10.50.20 | HMI | Wonderware | InTouch 2020 R2 | Primary Operator Station | Baseline |
| 10.10.50.21 | HMI | Wonderware | InTouch 2020 R2 | Backup Operator Station | Baseline |
| 10.10.50.30 | Flow Meter | ABB | AquaMaster 4 | Intake Flow Measurement | Baseline |
| 10.10.50.31 | Flow Meter | ABB | AquaMaster 4 | Discharge Flow Measurement | Baseline |
| 10.10.50.40 | RTU | Schneider Electric | SCADAPack 334E | Remote Pump House | Baseline |
| 10.10.50.50 | Analyzer | Honeywell | AQ4000 | Chlorine Residual Analyzer | Baseline |
| 10.10.50.55 | VFD | ABB | ACS580 | PS2 Variable Frequency Drive | New (Feb 18) |
Inventory change summary: One device added (ABB ACS580 VFD at 10.10.50.55). Zero devices removed. Zero unauthorized devices detected.
NERC CIP Compliance Mapping
The following table maps each applicable NERC CIP requirement to the specific evidence provided in this report. Hand this table and the referenced sections directly to your auditor.
| NERC CIP Standard | Requirement | How Kyntic Satisfies | Evidence |
|---|---|---|---|
| CIP-005-7 R1 | Electronic Security Perimeter monitoring | All IT-to-OT boundary crossings detected and logged with full connection metadata (source, destination, protocol, duration, bytes) | Section 3, 5 (Alerts 1, 2) |
| CIP-005-7 R2 | Interactive Remote Access management | All remote access sessions (RDP, VNC, SSH) to OT devices detected, logged, and correlated with maintenance schedules | Section 5 (Alerts 7, 8) |
| CIP-007-6 R3 | Security Patch Management | Device inventory tracks manufacturer, model, and firmware. Firmware updates logged as maintenance events | Section 7, Section 5 (Alert 6) |
| CIP-007-6 R4 | Security Event Monitoring | Continuous passive monitoring with 99.7% uptime coverage. 3.38M connections analyzed in Q1. All gaps documented | Section 2 |
| CIP-007-6 R4.2 | Alerting for security events | 8 alerts generated via deterministic rule engine. All investigated and dispositioned within 24 hours | Section 4, 5 |
| CIP-010-4 R1 | Configuration Change Management | New devices on OT network automatically detected and flagged (KYNTIC-004). Baseline comparison on every connection | Section 5 (Alert 3), Section 7 |
| CIP-010-4 R1.5 | Configuration Monitoring | Continuous inventory monitoring against established baseline. Change summary provided quarterly | Section 7 |
Evidence Integrity & Chain of Custody
All log data referenced in this report is preserved with the following integrity guarantees. These controls ensure that evidence is admissible for regulatory audit and cannot be altered after collection.
Log data for this reporting period is stored under the S3 prefix logs/SITE-WTP-01/2026-01-01-00/ through logs/SITE-WTP-01/2026-03-31-23/ and will be retained until Q1 2033.