I treated backup activity as an explanation to verify against the observed OT traffic and previous investigations. The aim was to determine whether the activity matched an understood operational process and to retain the supporting evidence in the incident record.
Viewed
UK Water Utility
Backup activity and OT context
Read the operation behind the OT alert
Return to the full story ←