Analyze programming details and changes
Enhance forensics by displaying programming events carried out on your network devices and analyzing code changes. This information helps you discover suspicious programming activity, for example:
Human error: An engineer is programming the wrong device.
Corrupted programming automation: Programming is erroneously carried out because of automation failure.
Hacked systems: Unauthorized users logged into a programming device.
You can display a programmed device and scroll through various programming changes carried out on it by other devices.
View code that was added, changed, removed, or reloaded by the programming device. Search for programming changes based on file types, dates, or times of interest.
When to review programming activity
You may need to review programming activity:
After viewing an alert regarding unauthorized programming
After a planned update to controllers
When a process or machine isn't working correctly (to see who carried out the last update and when)
Other options let you:
Mark events of interest with a star.
Download a *.txt file with the current code.
About authorized versus unauthorized programming events
Unauthorized programming events are carried out by devices that haven't been learned or manually defined as programming devices. Authorized programming events are carried out by devices that were resolved or manually defined as programming devices.
The Programming Analysis window displays both authorized and unauthorized programming events.
Accessing programming details and changes
Access the Programming Analysis window from the:
Use the event timeline to display a timeline of events in which programming changes were detected.
Unauthorized programming alerts
Alerts are triggered when unauthorized programming devices carry out programming activities.
You can also view basic programming information in the Device Properties window and Device Inventory.
Working in the programming timeline window
This section describes how to view programming files and compare versions. Search for specific files sent to a programmed device. Search for files based on:
|Programming timeline type||Description|
|Programmed Device||Provides details about the device that was programmed, including the hostname and file.|
|Recent Events||Displays the 50 most recent events detected by the sensor.
To highlight an event, hover over it and select the star.
The last 50 events can be viewed.
|Files||Displays the files detected for the chosen date and the file size on the programmed device.
By default, the maximum number of files available for display per device is 300.
By default, the maximum file size for each file is 15 MB.
|File status||File labels indicate the status of the file on the device, including:
Added: the file was added to the endpoint on the date or time selected.
Updated: The file was updated on the date or time selected.
Deleted: This file was removed.
No label: The file wasn't changed.
|Programming Device||The device that made the programming change. Multiple devices may have carried out programming changes on one programmed device. The hostname, date, or time of change and logged in user are displayed.|
|Displays the current file installed on the programmed device.|
|Download a text file of the code displayed.|
|Compare the current file with the file detected on a selected date.|
Choose a file to review
This section describes how to choose a file to review.
To choose a file to review:
Select an event from the Recent Events pane
Select a file from the File pane. The file appears in the Current pane.
This section describes how to compare programming files.
Select an event from the Recent Events pane.
Select a file from the File pane. The file appears in the Current pane. You can compare this file to other files.
Select the compare indicator.
The window displays all dates the selected file was detected on the programmed device. The file may have been updated on the programmed device by multiple programming devices.
The number of differences detected appears in the upper right-hand corner of the window. You may need to scroll down to view differences.
The number is calculated by adjacent lines of changed text. For example, if eight consecutive lines of code were changed (deleted, updated, or added) this will be calculated as one difference.
Select a date. The file detected on the selected date appears in the window.
The file selected from the Recent Events/Files pane always appears on the right.
Device programming information: Other locations
In addition to reviewing details in the Programming Timeline, you can access programming information in the Device Properties window and the Device Inventory.
|Device properties||The device properties window provides information on the last programming event detected on the device.|
|The device inventory||The device inventory indicates if the device is a programming device.
For more information, see Import device information to a sensor.
Submit and view feedback for