Skip to content

Installation of SINEC Security Guard Sensor app

Management of sensors

On- and Offboarding is described in Sensors.
Usage of notices Security events is described in Attacks.

Prerequisites for the SINEC Security Guard Sensor app

An Industrial Edge Device with at least two network interfaces is required. One of the two interfaces must be connected to the mirror port of the switch that is to be monitored.

To operate, the Industrial Edge Device needs access to the following URLs at the gateway interface:

To be able to securely store the data of the SINEC Security Guard Sensor app on the Industrial Edge Device, Siemens recommends the use of a physical IED with a TPM module.

For the secure operation of the SINEC Security Guard, comply with the defense in depth and hardening guidelines for the Industrial Edge Device.

New SINEC Security Guard Sensor app Installation

Preparing the sensor device and network

The SINEC Security Guard Sensor app is deployed on SIMATIC IPC 227E or any other Industrial Edge Device of same or higher performance class ①.

  1. Configure the mirror port of the switch in the target monitored network
  2. Identify the communication port ② and mirror port ③ for sensor device network interface
  3. Plug the network cable to connect the DHCP switch with the sensor communication port
  4. Connect to a monitor to find the DHCP IP address ④, MAC ⑤ and interface name ⑥; it helps to note down this information as it may be required in later steps

none

Number Description
① Example of a device where the SINEC Security Guard Sensor app is deployed at

none

Number Description
② X1 P1 - Communication Port
③ X2 P1 - Mirror Port

none

Number Description
④ DHCP IP address
⑤ MAC for communication port
⑥ Network interface name for communication port

Sensor device registration on Industrial Edge Management (IEM)

Add a new sensor device on IEM

  1. In the IE Management portal, 'Home' ① leads to the main functions of Industrial Edge; there, 'Edge Management' ② can be used to log into the Siemens IE management
  2. A button ③ in the tile 'Edge Devices' leads to the list of Edge devices for further management features

  3. To manage a specific Edge device, it needs to be shown in the list of Edge devices; if the desired Edge device is not shown in here, it can be created ④

    • On top left of the 'New Edge Device' screen, the steps to create a new device are shown ⑤; buttons on the top right provide navigation between the steps ⑥
    • In 'Device', the corresponding device type ⑦ needs to be chosen, and the sensor name ⑧ and the user name and password for logging in the IE device ⑨ need to be defined
    • When done, 'Next' ⑥ leads to the next step
    • The add button ⑩ can be used to open the dialogue for the network interface data

    • The “Gateway Interface” checkbox ⑪ needs to be ticked; the field for the MAC address ⑫ requires data which had been presented when preparing the sensor device and network; then the static IP address, gateway and DNS need to be entered ⑬; the button 'Add' ⑭ will close the dialogue, create the network interface and show it in the main dialogue ⑮

      Note
      The IP address can differ from the DHCP IP address.

    • An NTP server can optionally be added ⑯

    • When done, 'Next' ⑥ leads to the next step
    • If no proxy is needed, the settings in 'Proxy' ⑰ can be kept as they are; otherwise just customize
    • When done, 'Create' ⑥ closes the dialogue and creates the new edge device

  4. An edge device onboarding file will be downloaded automatically; to download it manually, click the newly created sensor edge device ⑱, open the menu ⑲ and select “Create Onboarding File” from the menu ⑳

none

Number Description
① Menu item 'Home'
② Tile 'Edge management'

none

Number Description
③ Button to show the list of Edge devices for further management

none

Number Description
④ Button 'Create'

none

Number Description
⑤ Steps of the dialogue
⑥ Navigation buttons 'Back', 'Next', 'Create' (their visibility depends on the currently selected step)

none

Number Description
⑦ Edge device type
⑧ Edge device name
⑨ Authentication information

none

Number Description
⑩ Button to add a network interface

none

Number Description
⑪ Checkbox 'Gateway interface'
⑫ Input field 'MAC address'
⑬ Form for IP address, gateway and DNS
⑭ Button to submit the network interface data

none

Number Description
⑮ Depiction of created network interface
⑯ Button to add an NTP server

none

Number Description
⑰ 'Proxy' settings

none

Number Description
⑱ Sensor Edge device
⑲ Button 'Menu'
⑳ Menu item 'Create Onboarding File'

Initialize the sensor device

  1. Access the IE Device portal with the DHCP IP address and show the “Activate Edge Device” dialog box. Add the edge device onboarding file ① and activate it ②.
  2. When the activation is successful, the display monitor will show the new static IP address ③.
  3. Then physically connect the communication port and mirror port of the sensor device with the target network.
  4. Access the IE device portal with the static IP address. On the 'Sign in' page, credentials can be entered ④ and submitted ⑤.
  5. When the sensor device is connected successfully to the IEM, the status indicator ⑧ switches to green and the IP address of the sensor device ⑦ is displayed.
  6. Continue with updating the Edge device OS

none

Number Description
① Upload field with 'Browse' button
② Button to activate the sensor device

none

Number Description
③ Static IP address

none

Number Description
④ Input fields for login credentials
⑤ Button to login

none

Number Description
⑥ Device tile
⑦ IP address of the sensor device
⑧ Status indicator

Update the Edge device OS

The SINEC Security Guard Sensor app requires IED-OS-v2.0 or a later version. For this an update of the OS of the Edge device may be required. It is recommended to always use the latest available version.

  1. Navigate to admin management by using the menu entry 'Admin Management' ①
  2. Navigate to 'Device Catalog' ④ to show all devices.
  3. Look for the corresponding device type IPC 227E ③; if the label is not fully visible, click the Info button ② to get the full information, including the type ⑤
  4. Click on the device ③ to see all available downloads
  5. Find the latest firmware version ⑥ and initiate the download ⑦
  6. After the download is completed, navigate to “Edge Management” ⑧
  7. Navigate to 'Edge Devices' ⑩
  8. Click 'System Commands' ⑨ and select 'Firmware Update' ⑪
  9. Select the edge device which needs to be updated ⑫
  10. Select the target firmware version ⑬
  11. Initiate the update process ⑭

none

Number Description
① Main navigation 'Admin Management'

none

Number Description
② Info button
③ Device type IPC 227E
④ Main navigation 'Device Catalogue'

none

Number Description
⑤ Information on device type

none

Number Description
⑥ Example of a listed OS firmware version
⑦ Download button
⑧ Main navigation 'Edge Management'

none

Number Description
⑨ Menu button 'System Commands'
⑩ Main navigation 'Edge Devices'
⑪ Menu item 'Firmware update'

none

Number Description
⑫ Example of a listed Edge device
⑬ Dropdown field containing available update versions
⑭ Button to initiate the update process

Ensure Device Connectivity

The SINEC Security Guard Sensor app requires a connection to the SINEC Security Guard Cloud. Please ensure that the device can communicate with the internet by following the guidance in the Industrial Edge User Manual. The manual also explains how to configure a proxy.

Create ticket in Service Desk

To provision the SINEC Security Guard Sensor app and register the sensor to SSG cloud, create a ticket in the Service Desk.

Provide the following information:

  • IE Hub Tenant ID ① - this is needed to provision the SINEC Security Guard Sensor app to your IE Hub

Use this as template for your ticket:

  • IE Hub Tenant ID: myIEHubTenant

Your IE Hub tenant will receive the SINEC Security Guard Sensor app.

none

Number Description
① IE Hub Tenant ID

SINEC Security Guard Sensor app installation

  1. Deploy the SINEC Security Guard Sensor app to IEM; if the App is approved and deployed by your IE Hub Tenant Admin, you can find the App in IEM at “Catalog“ ③
  2. Install the SINEC Security Guard Sensor app to sensor device
    1. Click the app icon ② and initiate the installation ④
    2. Click 'Next' ⑤ to keep the 'Configurations' by default
    3. Select target sensor device ⑥ and click 'Install Now' ⑦
    4. In the popup window, click 'Install' ⑧ to confirm the installation
    5. In the popup window, click 'Job Status' ⑨
    6. Navigate to the “Job Status” page ⑩; when job status changes to 'Completed' ⑪, the SINEC Security Guard Sensor app installation is successful
  3. Access the IE device portal ⑫ and check the running status ⑭ of the SINEC Security Guard Sensor app
  4. Now the SINEC Security Guard Sensor app is ready for onboarding in the Sensors

none

Number Description
② Main navigation 'Catalog'
③ App icon

none

Number Description
④ Button 'Install'

none

Number Description
⑤ Button 'Next'

none

Number Description
⑥ Target sensor device
⑦ Button 'Install Now'

none

Number Description
⑧ Button 'Install'

none

Number Description
⑨ Button 'Job Status'

none

Number Description
⑩ Main navigation 'Job status'
⑪ Status indicator on Job status page

none

Number Description
⑫ Main navigation 'Management'
⑬ SINEC Security Guard Sensor app
⑭ Status of SINEC Security Guard Sensor app