Healthcare (OT) - Module User Guide
This guide is meant to be used as a day-to-day reference for the Healthcare (OT) module's content. All the content included in this module is listed below, along with a detailed explanation, suggested response, and configuration and tuning notes.
Suppression Period: The Suppression Multiple in conjunction with the Suppression Period defines how much time must pass before the same AI Engine rule can be triggered again for the same set of criteria. Measured in minutes in this guide.
Environmental Dependence Factor: EDF is a high-level quantification of how much effort is required in configuration and tuning for an AI Engine rule to perform as expected. This setting has no impact on processing.
False Positive Probability: The False Positive Probability is used in Risk-Based Priority (RBP) calculation for AI Engine Rules. It estimates how likely the rule is to generate a false positive response. A value of "low" indicates the pattern the rule matches is almost always a true positive. However, a value of "high" indicates the pattern the rule matches is very likely to be a false positive.
Options range from 0 to 9 with:
- 0 indicating the pattern the rule matched is almost always a true positive.
- 9 indicating the pattern the rule matched is very likely to be a false positive.
AIE Rules
AIE Rule Name | HC: Account Added To Privileged Group |
---|---|
AIE Rule ID | 1567 |
AIE Rule Brief Description | Observes for an account added to an admin/privileged user group |
Classification | Security : Suspicious |
Event Suppression Period | 60 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | Low |
False Positive Probability | Low-Medium |
AIE Rule Additional Details | Use case: Configuration: |
AIE Rule Name | HC: Admin Password Modified |
---|---|
AIE Rule ID | 1568 |
AIE Rule Brief Description | Observes for an admin/privileged user password modification |
Classification | Security : Suspicious |
Event Suppression Period | 60 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | Medium |
False Positive Probability | Low-High |
AIE Rule Additional Details | Use case: Configuration: Optional configuration: |
AIE Rule Name | HC: Crit Application Config Change |
---|---|
AIE Rule ID | 1569 |
AIE Rule Brief Description | Observes for changes to critical application configurations |
Classification | Audit : Configuration |
Event Suppression Period | 1 |
Alarm on Event Occurrence | Yes |
Environmental Dependency Factor | Medium |
False Positive Probability | Low-Low |
AIE Rule Additional Details | Use case: Configuration: |
AIE Rule Name | HC: Crit Backup Failure |
---|---|
AIE Rule ID | 1570 |
AIE Rule Brief Description | Observes for failed critical backup events |
Classification | Operations : Critical |
Event Suppression Period | 1 |
Alarm on Event Occurrence | Yes |
Environmental Dependency Factor | Medium |
False Positive Probability | Low-Low |
AIE Rule Additional Details | Use case: Configuration: |
AIE Rule Name | HC: Crit Database Config Change |
---|---|
AIE Rule ID | 1571 |
AIE Rule Brief Description | Observes for changes to critical database configurations |
Classification | Audit : Configuration |
Event Suppression Period | 1 |
Alarm on Event Occurrence | Yes |
Environmental Dependency Factor | Medium |
False Positive Probability | Low-Low |
AIE Rule Additional Details | Use case: Configuration: |
AIE Rule Name | HC: Crit Net Access Config Change |
---|---|
AIE Rule ID | 1572 |
AIE Rule Brief Description | Observes for changes to critical network access configurations |
Classification | Audit : Configuration |
Event Suppression Period | 1 |
Alarm on Event Occurrence | Yes |
Environmental Dependency Factor | Medium |
False Positive Probability | Low-Low |
AIE Rule Additional Details | Use case: Configuration: |
AIE Rule Name | HC: Crit Service Stopped |
---|---|
AIE Rule ID | 1573 |
AIE Rule Brief Description | Observes for critical service stop events that are not followed by service start events |
Classification | Operations : Critical |
Event Suppression Period | 5 |
Alarm on Event Occurrence | Yes |
Environmental Dependency Factor | Medium |
False Positive Probability | Medium-Medium |
AIE Rule Additional Details | Use case: Configuration: |
AIE Rule Name | HC: Crit System Config Change |
---|---|
AIE Rule ID | 1574 |
AIE Rule Brief Description | Observes for changes to critical system configurations |
Classification | Audit : Configuration |
Event Suppression Period | 1 |
Alarm on Event Occurrence | Yes |
Environmental Dependency Factor | Medium |
False Positive Probability | Low-Low |
AIE Rule Additional Details | Use case: Configuration: |
AIE Rule Name | HC: Crit System Shutdown |
---|---|
AIE Rule ID | 1575 |
AIE Rule Brief Description | Observes for critical system shutdowns that are not followed by startup activity |
Classification | Audit : Startup and Shutdown |
Event Suppression Period | 30 |
Alarm on Event Occurrence | Yes |
Environmental Dependency Factor | Medium |
False Positive Probability | High-Low |
AIE Rule Additional Details | Use case: Configuration: |
AIE Rule Name | HC: Data Copy To Removable Device |
---|---|
AIE Rule ID | 1576 |
AIE Rule Brief Description | Observes for data transfer to a removable device (e.g., USB drive) |
Classification | Audit : Access Success |
Event Suppression Period | 1 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | None |
False Positive Probability | Medium-Medium |
AIE Rule Additional Details | Use case: Configuration: |
AIE Rule Name | HC: Default Or Weak Password |
---|---|
AIE Rule ID | 1577 |
AIE Rule Brief Description | Observes for a default or weak password |
Classification | Security : Vulnerability |
Event Suppression Period | 60 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | None |
False Positive Probability | Medium-Medium |
AIE Rule Additional Details | Use case: An adversary uses the hard-coded or default password of a medical device to force unscheduled downtime of the device |
AIE Rule Name | HC: Device Modified |
---|---|
AIE Rule ID | 1578 |
AIE Rule Brief Description | Observes for device modifications |
Classification | Audit : Access Success |
Event Suppression Period | 1 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | None |
False Positive Probability | Medium-Medium |
AIE Rule Additional Details | Use case: A hospital systems administrator creates a new medical device network profile or moves a medical device to a new network group |
AIE Rule Name | HC: Device Sent Plaintext Credentials |
---|---|
AIE Rule ID | 1579 |
AIE Rule Brief Description | Observes for device transmission of a plaintext password |
Classification | Security : Vulnerability |
Event Suppression Period | 60 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | None |
False Positive Probability | Medium-Medium |
AIE Rule Additional Details | Use case: An adversary conducting a man-in-the-middle attack on a hospital network obtains the password for a medical device |
AIE Rule Name | HC: Device Software Vulnerability |
---|---|
AIE Rule ID | 1580 |
AIE Rule Brief Description | Observes for device software vulnerabilities |
Classification | Security : Vulnerability |
Event Suppression Period | 60 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | None |
False Positive Probability | Medium-Medium |
AIE Rule Additional Details | Use case: A healthcare systems administrator has a requirement to identify medical devices affected by industry-specific recalls or security alerts |
AIE Rule Name | HC: Door Access Granted |
---|---|
AIE Rule ID | 1581 |
AIE Rule Brief Description | Observes for successful door authentications |
Classification | Audit : Access Success |
Event Suppression Period | 30 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | None |
False Positive Probability | Low-Low |
AIE Rule Additional Details | Use case: An individual successfully accesses a restricted room, office, elevator, etc. of a hospital via badge or biometric device |
AIE Rule Name | HC: Expired Certificate |
---|---|
AIE Rule ID | 1582 |
AIE Rule Brief Description | Observes for an expired TLS certificate |
Classification | Operations : Warning |
Event Suppression Period | 60 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | None |
False Positive Probability | Medium-Medium |
AIE Rule Additional Details | Use case: A certificate for a critical cloud-based service that provides ongoing instructions to a ventilator system expires while fetching patient data to determine next course of action treatment |
AIE Rule Name | HC: File Deletion Activity |
---|---|
AIE Rule ID | 1583 |
AIE Rule Brief Description | Observes for file deletions |
Classification | Security : Suspicious |
Event Suppression Period | 1 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | None |
False Positive Probability | Medium-Medium |
AIE Rule Additional Details | Use case: Configuration: |
AIE Rule Name | HC: Firmware Change |
---|---|
AIE Rule ID | 1584 |
AIE Rule Brief Description | Observes for device firmware changes |
Classification | Operations : Information |
Event Suppression Period | 60 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | None |
False Positive Probability | Medium-Medium |
AIE Rule Additional Details | Use case: An adversary with knowledge of a patient monitor hard-coded credentials vulnerability installs unauthorized firmware for malicious purposes |
AIE Rule Name | HC: Malicious IP |
---|---|
AIE Rule ID | 1585 |
AIE Rule Brief Description | Observes for device communication with a destination IP flagged as potentially malicious |
Classification | Security : Other Security |
Event Suppression Period | 1 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | None |
False Positive Probability | Medium-Medium |
AIE Rule Additional Details | Use case: A healthcare systems administrator requires insight into medical devices that are communicating with potentially malicious IP addresses |
AIE Rule Name | HC: Multiple Account Lockouts |
---|---|
AIE Rule ID | 1586 |
AIE Rule Brief Description | Observes for an account locked out multiple times (>=3) per hour |
Classification | Audit : Access Revoked |
Event Suppression Period | 60 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | Low |
False Positive Probability | Medium-Medium |
AIE Rule Additional Details | Use case: Configuration: |
AIE Rule Name | HC: Multiple Door Access Failures |
---|---|
AIE Rule ID | 1587 |
AIE Rule Brief Description | Observes for multiple failed door authentications |
Classification | Audit : Access Failure |
Event Suppression Period | 60 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | None |
False Positive Probability | Medium-Medium |
AIE Rule Additional Details | Use case: An individual has failed multiple times at accessing a restricted room, office, elevator, etc. of a hospital via badge or biometric device |
AIE Rule Name | HC: New Hardware Detected |
---|---|
AIE Rule ID | 1588 |
AIE Rule Brief Description | Observes for connection of a new external device (e.g., USB drive, keyboard, mouse) to a system |
Classification | Operations : Information |
Event Suppression Period | 60 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | None |
False Positive Probability | Medium-Medium |
AIE Rule Additional Details | Use case: An employee or adversary adds a new hardware device, such as a USB drive, keyboard, or mouse to a system |
AIE Rule Name | HC: New Medical Device |
---|---|
AIE Rule ID | 1589 |
AIE Rule Brief Description | Observes for a newly discovered medical device (e.g., infusion pump) |
Classification | Operations : Information |
Event Suppression Period | 60 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | None |
False Positive Probability | Medium-Medium |
AIE Rule Additional Details | Use case: A healthcare systems administrator adds a new infusion pump device to a hospital network |
AIE Rule Name | HC: Sensor Connected/Disconnected |
---|---|
AIE Rule ID | 1590 |
AIE Rule Brief Description | Observes for sensor connections/disconnections |
Classification | Operations : Information |
Event Suppression Period | 1 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | None |
False Positive Probability | Medium-Medium |
AIE Rule Additional Details | Use case: A healthcare organization requires constant real-time visibility into the health status of all network-connected medical devices |
AIE Rule Name | HC: SMBv1 Communication |
---|---|
AIE Rule ID | 1591 |
AIE Rule Brief Description | Observes for device communication over SMBv1 |
Classification | Operations : Network Traffic |
Event Suppression Period | 1 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | None |
False Positive Probability | Medium-Medium |
AIE Rule Additional Details | Use case: An adversary gains access to medical device and attempts to pivot to a network file server by creating an SMB session |
AIE Rule Name | HC: Software Install/Update Failure |
---|---|
AIE Rule ID | 1592 |
AIE Rule Brief Description | Observes for failed software installations/updates |
Classification | Operations : Warning |
Event Suppression Period | 1 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | None |
False Positive Probability | Medium-Medium |
AIE Rule Additional Details | Use case: A healthcare systems administrator requires visibility into unsuccessful system software installations/updates |
AIE Rule Name | HC: Software Installed/Updated |
---|---|
AIE Rule ID | 1593 |
AIE Rule Brief Description | Observes for successful software installations/updates |
Classification | Audit : Configuration |
Event Suppression Period | 60 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | None |
False Positive Probability | Medium-Medium |
AIE Rule Additional Details | Use case: A healthcare systems administrator implements a successful medical device or system software installation/update |
AIE Rule Name | HC: System Time Changed |
---|---|
AIE Rule ID | 1594 |
AIE Rule Brief Description | Observes for system time changes |
Classification | Audit : Other Audit Success |
Event Suppression Period | 60 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | None |
False Positive Probability | Medium-Medium |
AIE Rule Additional Details | Use case: An adversary successfully compromises a system and then modifies the system time (via manual or automated malware actions) to obfuscate the timing of further activities |
AIE Rule Name | HC: User Account Created |
---|---|
AIE Rule ID | 1595 |
AIE Rule Brief Description | Observes for creation of a new user account |
Classification | Audit : Account Created |
Event Suppression Period | 60 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | Low |
False Positive Probability | Low-Low |
AIE Rule Additional Details | Use case: An adversary has created a local, domain, or cloud account on a hospital network to access specific services or establish secondary or admin/privileged user group accounts |
AIE Rule Name | HC: Vulnerability Scan Event |
---|---|
AIE Rule ID | 1596 |
AIE Rule Brief Description | Observes for vulnerability scans |
Classification | Operations : Information |
Event Suppression Period | 60 |
Alarm on Event Occurrence | No |
Environmental Dependency Factor | None |
False Positive Probability | Medium-Medium |
AIE Rule Additional Details | Use case: A healthcare systems administrator requires visibility into potential vulnerabilities of networked medical devices |
Reports
Report Name | HC: AIE Alarm Summary |
---|---|
Class | Operations |
Description | Report summarizes all Healthcare (OT) Module AI Engine Alarm Activity |
Template Type | Executive Report |
Data Source | Platform Manager |