Environment

The page includes the following sections:

Monitored Networks

The Monitored Network configuration contains a set of IP ranges (CIDRs / subnets) that define the monitoring boundaries for OT Security. OT Security ignores assets outside of the configured ranges.

By default, OT Security configures three default public ranges: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, as well as the link-local range of 169.254.0.0/16 (APIPA).

To disable any of the default ranges or add ranges appropriate for your network:

  1. In the Monitored Network section, click Edit.

    The Monitored Network panel appears.

  2. Select the required Default IP ranges and/or add Additional IP ranges (one IP range per line) in the designated text box.

  3. Click Save.

    OT Security saves the monitored network configuration.

Fetch IP Address for IoT Assets

By default, when importing assets from an IoT connector, OT Security imports the IP address along with the MAC address of the devices. To import only the MAC address, disable the Fetch IP Address for IoT Assets option. For more information, see Managing IoT Connectors.

Event Clusters

To facilitate the monitoring of events, multiple events with the same characteristics are clustered together into a single cluster. The clustering is based on event type (that is, events that share the same policy), source, and destination assets, and so on.

To cluster events, they must be generated within the following configured time intervals:

  • Maximum time between consecutive events — Sets the maximal time interval between events. If this time passes, the consecutive events are not clustered.

  • Maximum time between the first and last event — Sets the maximal time interval for all events to be shown as a cluster. An event that is generated after this time interval is not be part of the cluster.

To enable clustering:

  1. The Event Clusters page appears.

  2. Click the toggle to enable desired categories for clustering.

  3. To configure the time intervals for a category, click Edit.

    The Edit Configuration window appears.

  4. Type the required number value in the number box and select the unit of time using the drop-down box.

    Note: For more information about clustering and time intervals, click the icon.

  5. Click Save.