VMDR OT Release 1.4
January 05, 2026
Modbus Support in Process Integrity Monitoring (PIM)
We have enhanced PIM capabilities to include the detection of events between assets communicating over the Modbus protocol.
This enhancement enables you to monitor Modbus-based communication between impacted and remote assets to identify any deviations from the expected behavior.
You can view the Modbus events on the Monitoring > Events tab.
With Modbus support added, we have introduced the following enhancements:
Modbus Specific AttributesModbus Specific Attributes
The Event Details page now includes additional Modbus protocol-specific attributes, such as:
- Function Code: Displays the Modbus function used to execute the operation.
- Object Type: Displays the type of Modbus object involved.
You can view these attributes in the Event Details page for any Modbus event.
Activity Logs for Modbus EventsActivity Logs for Modbus Events
A new Activity tab provides detailed visibility into Modbus activity, including read and write operations. The number of activities displayed for each operation is as follows:
- Read: Maximum 100 activities.
- Write: Maximum 50 activities.
You can view these details on the Event Details > Activity tab of any Modbus event.
New Report for PIM Events
We have introduced a new Monitoring Details report that enables you to generate a detailed and customized report for all PIM events. This provides you with a consolidated view of all process-related events detected across your OT environment.
You can create this report from the VMDR OT > Reports tab. Simply select Monitoring Details under Create Report.
Updated QQL Tokens
With this release, the following QQL token names are updated to align with the Token Standardization introduced in VMDR OT Release 1.3.1:
| Old Token Name | New Token Name |
|---|---|
| asset.vulnerabilities.count | asset.vulnerability.count |
| firmware.version | firmwareVersion |
| finding.host.operatingSystem.name | finding.operatingSystem.name |
New QQL Tokens
The following new QQL tokens are added in this release:
| Token | Tab | Description |
|---|---|---|
| event.modbus.functionCode | Monitoring > Events | Use this token to search Modbus events based on the function code used in the operation.
Example:
|
| event.modbus.objectData.address | Monitoring > Events | Use this token to search Modbus events based on the Modbus address accessed during the event.
Example:
|
| event.modbus.objectData.value | Monitoring > Events | Use this token to search Modbus events based on the value read or written at a specific Modbus address.
Example:
|
| event.modbus.objectType | Monitoring > Events |
Use this token to search Modbus events based on the type of Modbus object involved in the event. Supported values: Coil, Holding Register Example:
|
Issues Addressed
There are no issues addressed in this release.