Security incident detection based on historian configuration data collected over time

A networked computing system comprising:

• a processor;
• and
• memory storing program code structured to cause the processor to:
• receive a security audit request for a computing device of a computer system,
• receive, from a historian data store, a configuration log associated with the computing device,
• generate a first hash value based on the configuration log associated with the computing device,
• compare the first hash value to a second hash value corresponding to an event record associated with the computing device, resulting in a comparison result,
• determine, based on the comparison result, a security incident with respect to the computing device, and
• perform a mitigation operation based on the determined security incident.

A computer-readable storage medium having programming instructions encoded thereon structured to cause a processor to perform a method, the method comprising:

• receiving a security audit request for a computing device of a computer system,
• receiving, from a historian data store, a configuration log associated with the computing device,
• generating a first hash value based on the configuration log associated with the computing device,
• comparing the first hash value to a second hash value corresponding to an event record associated with the computing device, resulting in a comparison result,
• determining, based on the comparison result, a security incident with respect to the computing device, and
• generating a security alert indicative of the security incident with respect to the computing device.