Siemens SIMATIC CPU 410 System Manual page 138

Special functions of the CPU 410
9.4 Field Interface Security
Security Event
event ID
5 SE_LOGOFF
11 SE_ACCESS_PWD_ENSABLED
12 SE_ACCESS_PWD_DISABLED
13 SE_ACCESS_PWD_CHANGED
20 SE_ACCESS_DENIED
71 SE_SOFTWARE_INTEGRITY_CHECK_FAILE
D
75 SE_SESSION_CLOSED
94 SE_SECURITY_CONFIGURATION_CHANGE
D
95 SE_SESSION_ESTABLISHED
96 SE_CFG_DATA_CHANGED
97 SE_USER_PROGRAM_CHANGED
98 SE_OPMOD_CHANGED
99 SE_FIRMWARE_LOADED
100 SE_FIRMWARE_ACTIVATED
101 SE_SYSTEMTIME_CHANGED
Note
You can request the details of specific encodings from Customer Support.
Procedure
You can configure the sending of security events in HW Config as follows:
● Send Yes/No, common switch for all messages
● IP address of the SIEM server. You can specify two different IP addresses.
● The port number on the SIEM server
● You can assign a maximum of 4 IP addresses per station and assign all 4 IP addresses
to one interface (X5, X8).
138
Security Event Severity meaning
Cancel logon
Password protection was set up
Password protection was revoked
Password has been changed.
A connection setup from the outside is rejected because
Field Interface Security is activated for this interface
An attempt was made to install invalid firmware.
Connection closed
The CPU security settings have been changed.
Connection established
A configuration change was made
A PCS 7 user program change has been transferred
Operating state changed
A firmware change has been downloaded.
The previously downloaded firmware change has been acti-
vated.
The time of day has been reset.
CPU 410 Process Automation/CPU 410 SMART
System Manual, 05/2017, A5E31622160-AC