Rethinking Threat ID: 31671 (SCADA ICCP Unauthorized COTP Connection) — Is This Really Malicious?

[rodney23koy]

When reviewing security alerts, context is everything. Take Threat ID: 31671 ("SCADA ICCP Unauthorized COTP Connection Established"), for instance. The current description simply states: "This alert indicates that an ICCP client has successfully connected using OSI Connection Oriented Transport Protocol."

While seeing a successful connection pop up in an alert is certainly helpful for asset visibility, the description leaves a massive gap: it fails to explain what actually makes the event malicious or risky. A successful COTP (Connection-Oriented Transport Protocol) handshake on its own is just a normal network event—it happens every time legitimate control systems communicate. Without additional context—such as whether the source IP address is unauthorized, if the connection violates segmentation policies, or if it deviates from established baseline behavior—this alert risks becoming just another piece of alert fatigue.