domains / families / security / detecting-attacks-on-historian-servers

detecting-attacks-on-historian-servers

separate

'Detect cyber attacks on OT historian servers (OSIsoft PI, Ignition, GE

When to use

• When monitoring historian servers that bridge IT and OT networks for compromise indicators
• When detecting unauthorized queries or data manipulation in process historian databases
• When investigating lateral movement through historian servers between IT and OT zones
• When responding to alerts about exploitation of historian-specific vulnerabilities (CVE-2025-0921)
• When validating historian data integrity after a suspected OT security incident

When not to use

• general database security monitoring
• historian deployment and configuration
• IT-only data warehouse security

Skill page

Source