detecting-attacks-on-historian-servers

Query the PI Web API system status endpoint for connected clients and compare them against an authorized baseline. Also check recorded tag data for flatlines (constant values across many points) and gaps indicating deletion or replay attacks.

Replay attacks appear as flatlined tags where a constant value repeats across hundreds of data points, effectively bypassing PI compression. Check recorded values over a time window and flag tags where all values are identical despite expected process variation.

Yes, the detector supports Ignition via its status connections API using bearer token authentication, alongside OSIsoft PI via the PI Web API. It flags unauthorized client connections on both platforms.

A compromised historian initiates outbound connections to Level 1/2 devices on ports like 502, 102, 44818, or 20000, which it should never do since it only receives data. Also watch for unauthorized processes and logons from non-baseline sources.

Do not use it for general database security monitoring, historian deployment or configuration, or IT-only data warehouse security. Validate detections on a non-production instance and cross-check alerts against change and maintenance logs first.