Detection
Passive OT Monitoring
Achieve visibility of OT communications without introducing operational risk.
Defensive guide
Why should I care?
Active probing can disrupt fragile devices; passive collection avoids touching the process.
How to implement it
- Use network TAPs where possible; SPAN/mirror where TAPs are impractical
- Place sensors at zone boundaries and inside high-consequence zones
- Baseline assets, peers and protocol behaviour before writing detections
- Forward alerts to the SOC with OT context attached
What good looks like
- Coverage at every conduit
- Baselines maintained as the plant changes
- Alerts routed to people who understand the process
Common failure modes
- Sensors deployed with no baseline or tuning
- Alerting only IT staff with no process context
How to verify it
- Confirm a known device change appears in the monitoring data