OT IDS Command Center

Threat Detection & Incidents

IDS detection performance and confirmed incidents — alert volumes, critical share, detection categories, top alerting sites and the full incident log.

Total alerts

3,106

12.5%vs last month

Critical alerts

561

14.3%vs last month

Critical alert share

18.1%

1.7%vs last month

Confirmed incidents

43.5%vs last month

Detected by IDS

92.3%

13 incidents in Jul 2026

Alert reduction after tuning

9.4%

avg across 70 reporting sites

Alert trend

monthly totals across deployed sites, trailing 12 months

Critical vs non-critical alerts

monthly stacked totals

Critical share in Jul 2026: 18.1%

Alerts by category

detection category mix, latest month

Alerts by site

top 8 by alert volume, Jul 2026

Incident log

70 confirmed incidents, trailing 12 months

Incident	Month▼	Day	Site	Category	Summary	Severity	Detected by	MTTR	Status
INC-0104	Jul 2026	9	Buenos Aires, Argentina	Remote access anomaly	Vendor VPN session outside change window	High	IDS	3.7 h	Open
INC-0105	Jul 2026	22	Auburn Hills II, USA	Suspicious protocol usage	Telnet session to RTU from IT segment	High	IDS	9.7 h	Closed
INC-0106	Jul 2026	10	Shenzhen II, China	PLC programming activity	Unplanned logic download to controller	Critical	IDS	15.3 h	Closed
INC-0107	Jul 2026	10	Singapore V, Singapore	Lateral movement	SMB traversal between process cells	High	IDS	12.9 h	Open
INC-0108	Jul 2026	25	Singapore IV, Singapore	Malware activity	Malware beaconing from engineering workstation	High	IDS	16.9 h	Open
INC-0109	Jul 2026	19	Vaasa II, Finland	Malware activity	Malware beaconing from engineering workstation	High	IDS	6.9 h	Closed
INC-0110	Jul 2026	11	Ludvika, Sweden	Lateral movement	SMB traversal between process cells	High	IDS	8.1 h	Open
INC-0111	Jul 2026	10	Buenos Aires III, Argentina	Lateral movement	SMB traversal between process cells	High	Other	17.6 h	Closed
INC-0112	Jul 2026	18	Hanoi II, Vietnam	Lateral movement	SMB traversal between process cells	High	IDS	8.1 h	Closed
INC-0113	Jul 2026	17	Brisbane, Australia	PLC programming activity	Unplanned logic download to controller	High	IDS	16.3 h	Closed
INC-0114	Jul 2026	26	Stone, UK	Suspicious protocol usage	Telnet session to RTU from IT segment	High	IDS	12.8 h	Closed
INC-0115	Jul 2026	1	Tultitlán, Mexico	Remote access anomaly	Vendor VPN session outside change window	Critical	IDS	18.1 h	Open
INC-0116	Jul 2026	14	Montreal IV, Canada	Malware activity	Malware beaconing from engineering workstation	High	IDS	5.9 h	Closed
INC-0081	Jun 2026	9	Sorocaba, Brazil	Lateral movement	SMB traversal between process cells	High	IDS	18.1 h	Closed
INC-0082	Jun 2026	27	Chassieu, France	Malware activity	Malware beaconing from engineering workstation	High	IDS	9.9 h	Open
INC-0083	Jun 2026	8	Lagos, Nigeria	PLC programming activity	Unplanned logic download to controller	High	IDS	18.0 h	Open
INC-0084	Jun 2026	17	Lagos III, Nigeria	Lateral movement	SMB traversal between process cells	Critical	IDS	18.4 h	Open
INC-0085	Jun 2026	23	Memphis, USA	Remote access anomaly	Vendor VPN session outside change window	High	IDS	7.6 h	Closed
INC-0086	Jun 2026	9	Zaragoza II, Spain	Malware activity	Malware beaconing from engineering workstation	High	IDS	11.7 h	Closed
INC-0087	Jun 2026	19	Singapore II, Singapore	Remote access anomaly	Vendor VPN session outside change window	High	IDS	21.4 h	Closed
INC-0088	Jun 2026	20	Chassieu, France	Malware activity	Malware beaconing from engineering workstation	High	IDS	10.8 h	Open
INC-0089	Jun 2026	1	Cary III, USA	Suspicious protocol usage	Telnet session to RTU from IT segment	High	IDS	9.0 h	Closed
INC-0090	Jun 2026	14	Oviedo, Spain	Lateral movement	SMB traversal between process cells	Critical	IDS	11.5 h	Closed
INC-0091	Jun 2026	10	Dammam III, Saudi Arabia	Unauthorized communication	PLC contacted external IP over TCP 502	High	IDS	22.6 h	Open
INC-0092	Jun 2026	26	Johannesburg, South Africa	Malware activity	Malware beaconing from engineering workstation	High	IDS	7.9 h	Open
INC-0093	Jun 2026	3	Buenos Aires, Argentina	Malware activity	Malware beaconing from engineering workstation	High	IDS	12.5 h	Closed
INC-0094	Jun 2026	11	Brisbane, Australia	Suspicious protocol usage	Telnet session to RTU from IT segment	Critical	IDS	7.3 h	Closed
INC-0095	Jun 2026	23	Houston II, USA	Remote access anomaly	Vendor VPN session outside change window	High	IDS	18.6 h	Open
INC-0096	Jun 2026	2	Singapore II, Singapore	PLC programming activity	Unplanned logic download to controller	High	IDS	19.0 h	Closed
INC-0097	Jun 2026	16	Xiamen III, China	Lateral movement	SMB traversal between process cells	High	Other	7.4 h	Closed
INC-0098	Jun 2026	15	Shenzhen II, China	Suspicious protocol usage	Telnet session to RTU from IT segment	Critical	Other	6.7 h	Open
INC-0099	Jun 2026	4	Nairobi, Kenya	Suspicious protocol usage	Telnet session to RTU from IT segment	High	IDS	12.4 h	Open
INC-0100	Jun 2026	7	Memphis III, USA	Lateral movement	SMB traversal between process cells	High	IDS	13.5 h	Open
INC-0101	Jun 2026	21	Lima, Peru	Suspicious protocol usage	Telnet session to RTU from IT segment	High	IDS	17.7 h	Open
INC-0102	Jun 2026	27	Monterrey II, Mexico	Remote access anomaly	Vendor VPN session outside change window	High	IDS	8.7 h	Open
INC-0103	Jun 2026	8	Ludvika, Sweden	Unauthorized communication	PLC contacted external IP over TCP 502	Critical	IDS	6.8 h	Closed
INC-0074	May 2026	13	Singapore V, Singapore	PLC programming activity	Unplanned logic download to controller	High	IDS	20.8 h	Closed
INC-0075	May 2026	10	Bengaluru IV, India	Remote access anomaly	Vendor VPN session outside change window	High	IDS	7.9 h	Closed
INC-0076	May 2026	1	Doha III, Qatar	Suspicious protocol usage	Telnet session to RTU from IT segment	High	IDS	7.0 h	Closed
INC-0077	May 2026	21	Cary III, USA	Suspicious protocol usage	Telnet session to RTU from IT segment	Critical	IDS	4.7 h	Closed
INC-0078	May 2026	8	Chassieu, France	Malware activity	Malware beaconing from engineering workstation	High	IDS	17.3 h	Closed
INC-0079	May 2026	7	Chassieu, France	Lateral movement	SMB traversal between process cells	Critical	Other	4.1 h	Closed
INC-0080	May 2026	24	Vienna, Austria	Remote access anomaly	Vendor VPN session outside change window	High	IDS	9.4 h	Closed
INC-0063	Apr 2026	9	Brisbane, Australia	Malware activity	Malware beaconing from engineering workstation	High	IDS	14.5 h	Closed
INC-0064	Apr 2026	6	Tallinn II, Estonia	Malware activity	Malware beaconing from engineering workstation	High	Other	22.8 h	Closed
INC-0065	Apr 2026	15	Hanoi II, Vietnam	PLC programming activity	Unplanned logic download to controller	Critical	IDS	12.0 h	Closed
INC-0066	Apr 2026	17	Porto, Portugal	Remote access anomaly	Vendor VPN session outside change window	High	Other	6.2 h	Closed
INC-0067	Apr 2026	18	Vaasa IV, Finland	PLC programming activity	Unplanned logic download to controller	High	Other	7.7 h	Closed
INC-0068	Apr 2026	6	Singapore II, Singapore	Unauthorized communication	PLC contacted external IP over TCP 502	High	IDS	19.9 h	Closed
INC-0069	Apr 2026	3	Charleroi III, Belgium	Lateral movement	SMB traversal between process cells	High	Other	6.1 h	Closed
INC-0070	Apr 2026	24	Singapore, Singapore	Suspicious protocol usage	Telnet session to RTU from IT segment	High	IDS	20.2 h	Closed
INC-0071	Apr 2026	4	Blumenau II, Brazil	Suspicious protocol usage	Telnet session to RTU from IT segment	Critical	IDS	16.0 h	Closed
INC-0072	Apr 2026	6	Wichita Falls, USA	Suspicious protocol usage	Telnet session to RTU from IT segment	Critical	IDS	22.7 h	Closed
INC-0073	Apr 2026	13	Cary, USA	Remote access anomaly	Vendor VPN session outside change window	High	Other	11.2 h	Closed
INC-0060	Mar 2026	26	Singapore V, Singapore	Unauthorized communication	PLC contacted external IP over TCP 502	Critical	IDS	22.5 h	Closed
INC-0061	Mar 2026	21	Busan III, South Korea	PLC programming activity	Unplanned logic download to controller	High	IDS	5.0 h	Closed
INC-0062	Mar 2026	16	Lagos, Nigeria	Lateral movement	SMB traversal between process cells	Critical	Other	14.2 h	Closed
INC-0052	Feb 2026	8	Dammam III, Saudi Arabia	Unauthorized communication	PLC contacted external IP over TCP 502	High	Other	22.6 h	Closed
INC-0053	Feb 2026	10	Houston II, USA	Remote access anomaly	Vendor VPN session outside change window	High	IDS	21.3 h	Closed
INC-0054	Feb 2026	7	Johannesburg, South Africa	Malware activity	Malware beaconing from engineering workstation	Critical	IDS	11.0 h	Closed
INC-0055	Feb 2026	5	Bengaluru II, India	PLC programming activity	Unplanned logic download to controller	Critical	IDS	21.2 h	Closed
INC-0056	Feb 2026	8	Buenos Aires III, Argentina	Remote access anomaly	Vendor VPN session outside change window	High	Other	4.3 h	Closed
INC-0057	Feb 2026	26	Busan III, South Korea	Malware activity	Malware beaconing from engineering workstation	High	IDS	9.3 h	Closed
INC-0058	Feb 2026	18	Sorocaba, Brazil	Unauthorized communication	PLC contacted external IP over TCP 502	High	IDS	8.2 h	Closed
INC-0059	Feb 2026	4	Lagos, Nigeria	Suspicious protocol usage	Telnet session to RTU from IT segment	Critical	IDS	5.2 h	Closed
INC-0050	Jan 2026	17	Memphis, USA	Suspicious protocol usage	Telnet session to RTU from IT segment	High	IDS	3.7 h	Closed
INC-0051	Jan 2026	3	Eindhoven, Netherlands	PLC programming activity	Unplanned logic download to controller	High	Other	20.3 h	Closed
INC-0049	Dec 2025	10	Singapore II, Singapore	Lateral movement	SMB traversal between process cells	Critical	IDS	8.2 h	Closed
INC-0047	Nov 2025	16	Hanoi III, Vietnam	Suspicious protocol usage	Telnet session to RTU from IT segment	High	IDS	6.8 h	Closed
INC-0048	Nov 2025	5	Cary III, USA	Suspicious protocol usage	Telnet session to RTU from IT segment	High	Other	11.4 h	Closed

All times shown in local time of selected region · Data refresh every 15 minutes