Passive Intrusion Detection for an Auto Supplier's Plant Network
Overview
What this challenge is about.
Passive Intrusion Detection for an Auto Supplier's Plant Network. Advanced challenge in design. Designing real products under real constraints, earn a blockc...
The Brief
What you'll do, and what you'll demonstrate.
Detect attacks on a converged office-and-factory network using only listen-only Zeek and Suricata sensors, with eight industrial-protocol detections and a three-plant pilot plan that never touches a controller.
This is not a design exercise. It is the work a product designer does between a brief and a shipped interface. That distinction matters to every hiring manager who has seen candidates redesign Spotify's homepage and none who have worked under real product constraints.
When you finish, you will have something most graduates do not: a real-world deliverable, verified by Ewance, that you can show to a hiring manager and say "I did this. Here is the proof."
Earning criteria — what you'll demonstrate
- Place passive network sensors to maximize visibility across a converged office-and-factory architecture without modifying plant-floor devices
- Translate industrial-protocol behavior (Modbus, OPC UA, PROFINET) into precise, low-noise detections in Zeek and Suricata
- Validate detections against labeled traffic to balance true-positive coverage with false-positive control
- Plan a multi-site security rollout that respects factory maintenance windows and central log aggregation
- Map detections to a recognized industrial-attack framework so coverage is auditable
Program Fit
Where this fits in your program.
Sharpens the same skills your degree expects you to demonstrate.
Aligned coursework coming soon.
Skills
Skills you'll demonstrate.
Each one shows up on your verified credential.
- Intrusion Detection
Apply intrusion detection to solve real industry problems and demonstrate production-level capability.
- Ot Security
Apply ot security to solve real industry problems and demonstrate production-level capability.
- Zeek
Apply zeek to solve real industry problems and demonstrate production-level capability.
- Suricata
Apply suricata to solve real industry problems and demonstrate production-level capability.
- Siem
Apply siem to solve real industry problems and demonstrate production-level capability.
- Protocol Security
Apply protocol security to solve real industry problems and demonstrate production-level capability.
Careers
Career paths this challenge builds toward
Completing this challenge demonstrates skills that transfer directly to these roles:
OT Security Engineer
This challenge mirrors the core of factory-floor security work: instrumenting a converged network passively, writing protocol-aware detections, and rolling out across plants without disrupting production. You leave able to defend industrial environments where agents are not an option.
This challenge sharpens
- ot-security
- intrusion-detection
- protocol-security
Detection Engineer
Authoring eight validated detections against labeled traffic and tuning them for low noise is exactly what detection engineers do daily. You practice the build-test-tune loop and the discipline of measuring true and false positives before shipping a rule.
This challenge sharpens
- intrusion-detection
- zeek
- suricata
Security Operations Analyst
Routing sensor logs into a central event platform and writing a deterministic tuning runbook bridges directly to security-operations work, where analysts triage industrial alerts and continuously reduce noise across monitored sites.
This challenge sharpens
- siem
- intrusion-detection
- ot-security