SCADA network diagrams

Identifies substantive SCADA, ICS, and OT network diagrams and topologies. Topic phrases are retained for discovery; enforcement requires control-zone, DMZ, trust-boundary, remote-site, communications, Purdue-level, field-network, or data-flow relationships, and high confidence also requires populated VLAN, address, HMI, RTU, PLC, DCS, or site detail.

Type

regex

Engine

boost_regex

Confidence

medium

Confidence justification

Medium confidence requires control-network relationships rather than a generic diagram. High confidence adds a populated network or control-asset value.

Detection quality

Not detected

Jurisdictions

global

Regulations

GDPR

Data categories

security

Scope

wide

Risk rating

9

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?is)\b(?:SCADA\s+network\s+(?:diagram|topology)|ICS\s+network\s+(?:diagram|topology)|industrial\s+control\s+network\s+diagram|OT\s+network\s+(?:diagram|topology)|control\s+system\s+network\s+diagram)\b

Corroborative evidence keywords

scada network diagrams, scada, network, diagrams, critical, infrastructure, systems, SCADA, [object Object], [object Object], [object Object], Modbus, Modbus TCP, Modbus RTU, DNP3, OPC-UA, OPC Classic, IEC 61850, IEC 60870, IEC 60870-5-104 (+9 more)

Proximity: 300 characters

Should match

• SCADA network diagram — Low-tier probe - diagram topic without control-network relationships
• SCADA network diagram: control zone, DMZ trust boundary, remote-site communications path, Purdue level 3, and process data flow — Medium-tier probe - substantive control-network relationships without populated live values
• SCADA network diagram for production site North Plant: control zone VLAN 120, HMI node HMI-02 at 10.24.8.10, RTU node RTU-07 at 10.24.8.15 — High-tier probe - topology relationships with populated VLAN, node, site, and address detail

Should not match

• unrelated generic text without domain phrases — No relevant topic phrases present
• placeholder value 12345 — Random text should not match topic-specific regex
• scada network diagram — Bare topic phrase surfaces only in discovery
• The vendor guide presents a generic SCADA network architecture. — Product overview without a control-network diagram or relationships
• Training example: SCADA network diagram with VLAN 120, HMI-02 at 10.24.8.10, and RTU-07 — Explicit training content must not enforce

Known false positives

• Vendor reference architectures, standards, and OT courses discuss SCADA networks, Purdue levels, DMZs, and remote sites without exposing a live topology. Mitigation: Keep diagram topics discovery-only and require control-zone, trust-boundary, communications, remote-site, field-network, or data-flow relationships for enforcement.
• Training diagrams can contain realistic VLANs, addresses, site names, and HMI/RTU/PLC identifiers. Mitigation: Reject explicit template, demo, tutorial, sample-data, and training-example framing from enforcing tiers.

References

• https://www.legislation.gov.au/C2018A00029/latest/text
• https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism