Anomalous event aggregation for analysis and system response

A system, comprising:

• one or more processors;
• and
• a memory having stored thereon instructions that, upon execution by the one or more processors, cause the one or more processors to:
• receive, in a user interface of an industrial automation application, a configuration for a response to an anomaly type on an industrial automation device, wherein:
• the configuration comprises context information of the industrial automation device and action information of the industrial automation device,
• the context information comprises operational parameters for identifying the anomaly type on the industrial automation device, and
• the action information comprises one or more physical actions to be performed on the industrial automation device in response to detecting the anomaly type in complete event data of the industrial automation device;
• receive, from a plurality of industrial automation devices including the industrial automation device, event data describing one or more cybersecurity events that occurred on an associated industrial automation device of the plurality of industrial automation devices, wherein the plurality of industrial automation devices are performing industrial automation processes in an industrial automation environment;
• for each of the one or more cybersecurity events:
• normalize the event data describing a respective cybersecurity event to generate normalized event data describing the respective cybersecurity event that occurred on the associated industrial automation device, and
• supplement the normalized event data with the context information relevant to the associated industrial automation device for the respective cybersecurity event to generate the complete event data for the respective cybersecurity event for the associated industrial automation device;
• identify the anomaly type for the industrial automation device of the plurality of industrial automation devices based on analyzing the complete event data associated with the industrial automation device;
• and
• in response to the identifying the anomaly type for the industrial automation device, perform the one or more physical actions on the industrial automation device to mitigate damage based on the action information and the context information in the configuration.