Monitoring

What is monitoring?

Monitoring is the continuous collection, observation and analysis of data from processes, systems and networks to keep track of their status, performance and security, so that you can intervene in time when something deviates. Where IT and OT come together, three forms exist side by side: process monitoring of the plant itself, monitoring of the IT infrastructure, and security monitoring of cyber threats. Each form has its own sources, tools and owners, but they only work really well in combination.

Monitoring is the eyes and ears of the OT network: without monitoring, detection, fault analysis and incident response are impossible.

🧠 How does monitoring work?

Every form of monitoring goes through the same four steps:

1. Data collection from various sources:

• Network traffic, for example via a SPAN port or a network TAP
• System logs (Syslog, Windows Event Logs)
• Devices such as PLCs, SCADA and HMIs, and sensors in the field
• Security tools such as Firewall, EDR, IDS and SIEM

2. Analysis of that data for:

• Performance - uptime, Latency, CPU and memory usage
• Anomalies - via thresholds or anomaly detection
• Incidents - intrusion attempts, Ransomware, privilege misuse

3. Visualisation and alerting via dashboards, alarms and reports
4. Follow-up, manually by an operator or analyst, or automated via SOAR and alarm flows

Monitoring can be used proactively (early detection, spotting trends) as well as reactively (incident analysis and root-cause analysis afterwards).

🔍 What types of monitoring exist in IT/OT?

The forms differ in purpose, sources and owner; in practice the three main forms are split further:

In practice these forms overlap. A sudden traffic spike can be a faulty switch, a misconfigured device or an attack. That is exactly why it pays to combine the forms rather than organise them in isolation.

🏭 What should you monitor in an industrial environment?

• Communication between PLC and HMI - unexpected connections, new protocols or polling that stops
• Logins and actions on the Engineering Station or SCADA server - especially outside working hours or from unknown systems
• Changes to Firmware and PLC logic - a program download or a switch to program mode is a signal that should always be followed up
• Network load and performance - overloaded segments, packet loss and unexpected traffic spikes
• New devices - every unknown MAC or IP address should trigger a check against the asset inventory
• Process data in the historian - for trend analysis and root-cause analysis after a failure
• Field device diagnostics - status signals according to NAMUR NE 107 (Failure, Function check, Out of specification, Maintenance required) as a basis for predictive maintenance

🔄 What is the difference between passive and active monitoring in OT?

With passive monitoring, a sensor only listens via a SPAN port or TAP and never sends traffic into the network itself. With active monitoring, the monitoring system contacts devices directly, for example with a ping, an SNMP request or a vulnerability scan.

Active scanning is risky in OT because many controllers have a limited network stack. A port scan or an unexpected packet can make an older PLC hang, disrupt communication or be interpreted by a safety system as a fault. NIST SP 800-82 (Rev. 3, September 2023) therefore favours passive techniques on production networks. Modern OT platforms such as Claroty, Nozomi, Dragos and Tenable OT combine passive detection with controlled, protocol-aware querying.

🔧 Which tools and protocols do you use for monitoring?

A few protocols keep coming back. SNMP queries status via UDP port 161 and receives traps on port 162; on OT networks, preferably use SNMPv3, the only version with authentication and encryption. Syslog (RFC 5424) traditionally sends log lines unencrypted over UDP 514, or over TLS on port 6514. Without correct time synchronisation via NTP or PTP, you cannot reliably line up events from different sources.

🚨 How do you set up alerting and dashboards properly?

Too many alarms are just as dangerous as too few: important messages disappear into the noise. For process alarms, ISA-18.2 gives concrete benchmarks for alarm management:

• On average about 1 alarm per 10 minutes per operator is very likely acceptable; around 2 per 10 minutes is still manageable
• More than 10 alarms in 10 minutes counts as an alarm flood; aim for this to occur less than 1% of the time
• Every alarm requires an action - a message that nobody needs to respond to is information, not an alarm

The same principle applies to security alerts in a SOC: tune detection rules to your own environment and measure how many alerts turn out to be false positives. Build dashboards per audience. An operator needs a calm process display following ISA-101, a network administrator an availability overview, and an analyst a timeline of events.

📊 Which KPIs belong to monitoring?

With a limited set of KPIs you can show whether monitoring is doing its job:

🔐 How does monitoring support security and compliance?

Monitoring is a fixed building block of Defense in Depth and Zero Trust: no preventive measure is watertight, so you need to see when something goes wrong anyway. Key points:

• Combine with a SIEM for correlation, alerting and forensic logging
• Enrich with threat intelligence and map detections to MITRE ATT&CK for ICS
• Synchronise time via NTP for forensic reliability
• Keep monitoring non-invasive - use SPAN or TAP for passive network access, give monitoring tools read-only rights and avoid inline components on critical OT links
• Assign follow-up - in your own SOC, a specialised OT SOC or with an MSSP

Standards and legislation make monitoring explicit. IEC 62443-3-3 requires auditable events (SR 2.8), read-only access to audit logs (SR 6.1) and continuous monitoring (SR 6.2). ISO 27001:2022 added control 8.16 Monitoring activities alongside 8.15 Logging. The NIS2 Directive requires an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report no later than one month after that notification. In the Netherlands this is implemented by the Cyberbeveiligingswet (Dutch Cybersecurity Act), which entered into force on 15 August 2026. For digital service providers such as cloud and data centre providers and managed (security) service providers, Implementing Regulation (EU) 2024/2690 also explicitly prescribes monitoring and logging. Without working monitoring, you simply cannot meet those deadlines.

🧭 How do you set up monitoring step by step?

1. Determine what is critical - which processes, systems and connections must never fail or change unnoticed?
2. Map your assets - start with passive asset discovery and complete the asset inventory.
3. Choose measurement points - place SPAN ports or TAPs at the transitions between zones, for example around the DMZ and the supervisory level.
4. Centralise logs - send logs from firewalls, servers, switches and engineering software to one platform with correct time.
5. Define use cases - for example a PLC download outside a change window, a new device or a login from the office network.
6. Organise follow-up - record who assesses alerts 24/7 and when operations are involved.
7. Evaluate periodically - measure the KPIs, remove superfluous alarms and test detection through exercises.

❓ Frequently asked questions

What is the difference between monitoring and logging?

Logging is recording events in log files, such as a login or a configuration change. Monitoring is actively watching and analysing those logs and other data to spot anomalies and respond to them. Logging therefore supplies the raw material that monitoring works with.

Why is active scanning dangerous on an OT network?

Many PLCs and RTUs have a limited network stack and were not built for unexpected or heavy network traffic. An active scan can make such a controller hang or disrupt its communication with SCADA, resulting in lost production. That is why passive monitoring via SPAN or TAP is preferred in OT.

What is the difference between process monitoring and security monitoring?

Process monitoring checks whether the plant is running properly, for example temperatures, pressures, alarms and production counts in SCADA and the historian. Security monitoring checks whether systems and networks are being attacked or misused, for example via SIEM and NDR. The two complement each other, because an attack can also show up as a process anomaly.

Do you need a SOC for OT monitoring?

Monitoring only has value if someone assesses and follows up the alerts. Larger organisations set up their own SOC or OT SOC for this, while smaller ones often outsource follow-up to an MSSP with OT expertise. What matters is that operations always stay involved in decisions that affect the process.

Which tools are used for OT network monitoring?

OT network monitoring uses specialised platforms that understand industrial protocols, such as Claroty, Nozomi Networks, Dragos and Tenable OT. These tools discover assets passively, build a picture of normal traffic and report deviations. Their alerts are usually forwarded to a central SIEM.

Is monitoring mandatory under NIS2 and the Cyberbeveiligingswet?

NIS2 and the Dutch Cyberbeveiligingswet require organisations to take appropriate risk management measures, handle incidents and give an early warning of a significant incident within 24 hours. Without monitoring you cannot detect incidents in time and therefore cannot meet that reporting obligation. In practice, monitoring is thus a necessary part of compliance.

📌 In summary

Monitoring is the foundation for visibility, detection and control in IT and OT environments: it watches processes, infrastructure and security and flags deviations before they lead to failures or incidents. By combining process monitoring, infrastructure monitoring and security monitoring, preferably passive in OT, you build a resilient OT landscape with insight into performance and threats alike.