Sharang ParnerkarandClaude Opus 4.8
a959e86194
CI / Check (pull_request) Successful in 5m16s
CI / Detect Changes (pull_request) Has been skipped
CI / Deploy Agent (pull_request) Has been skipped
CI / Deploy Dashboard (pull_request) Has been skipped
CI / Deploy Docs (pull_request) Has been skipped
CI / Deploy MCP (pull_request) Has been skipped
Rounds out the ICS probe's protocol coverage and adds recon. - pipeline::ics::ethernetip — read-only EtherNet/IP (CIP) reachability probe: a ListIdentity encapsulation request on 44818; emits `ics-ethernetip-exposed` (High, CWE-306). - pipeline::ics::portscan — concurrent TCP connect-scan of a curated OT/ICS + insecure-management port set (S7 102, DNP3 20000, Niagara Fox 1911, CODESYS 11740, PCWorx, OMRON FINS, Red Lion, Telnet 23, FTP 21), excluding the deep-probed 502/4840/44818. Emits `ics-service-exposed` per open port (ICS → High/CWE-306, cleartext mgmt → Medium/CWE-319). - probe_target now runs Modbus + OPC UA + EtherNet/IP deep probes plus the service scan. Unit-tested against in-process mock servers + a bound-port scan. This completes the dynamic ICS probing scope of #148; the OpenPLC/QEMU harnesses are scaffolded in orca-infra for the infra pass. Tracker #167. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>