Passive Intrusion Detection for an Auto Supplier's Plant Network
Overview
What this challenge is about.
Design passive Zeek and Suricata sensors for an auto plant, write eight OT attack detections, and create a pilot plan. Get a verifiable certificate.
The scenario
The supplier machines and assembles powertrain and chassis components, where an hour of unplanned line downtime can cost six figures and a corrupted controller can scrap a production batch. Its factory floors mix decade-old programmable controllers with modern OPC UA gateways, so any security tooling must observe the network passively rather than alter the devices on it.
The Brief
What you'll do, and what you'll demonstrate.
Detect attacks on a converged office-and-factory network using only listen-only Zeek and Suricata sensors, with eight industrial-protocol detections and a three-plant pilot plan that never touches a controller.
Earning criteria — what you'll demonstrate
- Place passive network sensors to maximize visibility across a converged office-and-factory architecture without modifying plant-floor devices
- Translate industrial-protocol behavior (Modbus, OPC UA, PROFINET) into precise, low-noise detections in Zeek and Suricata
- Validate detections against labeled traffic to balance true-positive coverage with false-positive control
- Plan a multi-site security rollout that respects factory maintenance windows and central log aggregation
- Map detections to a recognized industrial-attack framework so coverage is auditable
Program Fit
Where this fits in your program.
Sharpens the same skills your degree expects you to demonstrate.
Aligned coursework coming soon.
Skills
Skills you'll demonstrate.
Each one shows up on your verified credential.
- Intrusion Detection
Apply intrusion detection to solve real industry problems and demonstrate production-level capability.
- Ot Security
Apply ot security to solve real industry problems and demonstrate production-level capability.
- Zeek
Apply zeek to solve real industry problems and demonstrate production-level capability.
- Suricata
Apply suricata to solve real industry problems and demonstrate production-level capability.
- Siem
Apply siem to solve real industry problems and demonstrate production-level capability.
- Protocol Security
Apply protocol security to solve real industry problems and demonstrate production-level capability.
Careers
Career paths this challenge builds toward
Completing this challenge demonstrates skills that transfer directly to these roles:
OT Security Engineer
This challenge mirrors the core of factory-floor security work: instrumenting a converged network passively, writing protocol-aware detections, and rolling out across plants without disrupting production. You leave able to defend industrial environments where agents are not an option.
This challenge sharpens
- ot-security
- intrusion-detection
- protocol-security
Detection Engineer
Authoring eight validated detections against labeled traffic and tuning them for low noise is exactly what detection engineers do daily. You practice the build-test-tune loop and the discipline of measuring true and false positives before shipping a rule.
This challenge sharpens
- intrusion-detection
- zeek
- suricata
Security Operations Analyst
Routing sensor logs into a central event platform and writing a deterministic tuning runbook bridges directly to security-operations work, where analysts triage industrial alerts and continuously reduce noise across monitored sites.
This challenge sharpens
- siem
- intrusion-detection
- ot-security