// OF-03 · Observe
OT network monitoring: see what happens, with alerts your team can act on.
A visibility design for your industrial network: where to capture, what normal looks like, which tool to choose and what to do when an alert fires. Built for small teams without a dedicated SOC.
The problem
Many companies buy an OT monitoring tool and six months later have a dashboard full of alerts nobody reads. Others have no visibility at all and only find a problem when the line stops.
Useful visibility starts before the tool: knowing where to capture, understanding normal traffic and deciding which alerts deserve a response.
What we design
- Capture points (SPAN, TAP, port mirroring) per zone and per cell, with minimal impact on the network.
- A baseline of normal traffic: who talks to whom, over which protocols and how often.
- Requirements and comparison of OT monitoring and detection tools, commercial or open source, without vendor bias.
- Centralised logging for firewalls, switches, remote access and OT servers, with suitable retention.
- Change detection: new devices, new connections, PLC program changes, out-of-hours access.
- Integration with your existing SOC or MSP, if you have one.
Alerts you can act on
Each relevant alert is tied to a short runbook: what it means, how to confirm it, who decides and what to do. The goal is few alerts, each with an owner.
What you get
- Visibility design with capture points and the flow of monitoring data.
- OT traffic baseline report.
- Requirements matrix and tool comparison.
- Logging and retention policy.
- Runbooks for the priority alerts.
Frequently asked questions
Do we need a SOC to monitor the OT network?
Not necessarily. For many industrial SMEs, a small set of well-chosen alerts with runbooks and a clear owner works better than an external SOC with no context about the plant.
Does traffic capture affect production?
SPAN or TAP capture is passive. The design checks switch capacity and avoids mirroring ports on overloaded critical links.
Do you help choose the tool?
Yes, with a requirements matrix and an independent comparison. We do not resell licences or take vendor commissions.
Does monitoring help with NIS2 incident reporting?
Yes. Without detection and logging it is hard to spot an incident in time and gather the information the notification to CNCS requires.
Last updated: November 2026.