Enhancing Situational Awareness in Smart Grids through Event Correlation for ATT&CK Mapping

The increasing complexity and connectivity of Smart Grids (SGs) have made them vulnerable to cyber-physical threats, highlighting the need for improved situational awareness in the energy domain.To meet this need, we present ECAM (Event Correlation for ATT&CK Mapping), an approach that uses the Industrial Control Systems (ICS)-specific MITRE ATT&CK framework to support the correlation and interpretation of security events.We outline a workflow for implementing and testing ECAM, aimed at strengthening the security of future power grids.The approach successfully maps the conducted attacks to techniques T0814 (Denial of Service) and T0830 (Adversary-in-the-Middle), demonstrating its effectiveness in improving situational awareness.Therefore, we propose the ECAM approach along with a workflow to guide future research and advancements.