What is Security Monitoring?
Security monitoring is the continuous collection, observation and analysis of events on networks and systems in order to detect attacks, misuse, misconfigurations and other anomalies early and respond to them in time. It is the detection side of security: preventive controls such as firewalls and segmentation reduce the chance of an attack, while monitoring makes sure you see an attack that gets through anyway. In OT environments the stakes go beyond data: what is at risk is the availability and safety of a physical process.
The faster you spot an intruder, the smaller the damage. According to Mandiant’s M-Trends 2025 report, attackers in 2024 spent a global median of 11 days inside a network before being discovered; when organisations found the intrusion themselves this was 10 days, after an external notification 26 days.
🧠 How does security monitoring work?
Security monitoring is a chain of five steps, from raw event to handled incident:
- Collect - logs and network traffic arrive from firewalls, switches, servers, EDR agents, Syslog sources and network sensors. Network traffic is copied via a SPAN port or a TAP.
- Normalise and correlate - a SIEM converts events into a single format, gives them a reliable timestamp and links events from different sources.
- Detect - rules, signatures (IDS/IPS), threat intelligence and behavioural analysis, sometimes using machine learning, generate alerts.
- Assess - analysts in a SOC (Security Operations Center) decide whether an alert is genuine (triage) and how serious it is.
- Respond - through playbooks, optionally automated with SOAR, a confirmed incident is handed over to incident response.
Security monitoring therefore lays the foundation for Incident Response, Threat Hunting and forensic investigation: without retained logs, nobody can reconstruct afterwards what actually happened.
🔍 Which detection methods exist?
No single method sees everything. A mature monitoring approach combines them.
| Method | How it works | Strong at | Weak at |
|---|---|---|---|
| Signatures | Compares traffic and files with known patterns, such as Suricata or Snort rules | Known malware and exploits, few false positives | New or modified attacks |
| Anomaly detection | Learns a baseline of normal behaviour and flags deviations, see Anomaly Detection | Unknown attacks, new devices, new connections | False positives in dynamic networks |
| Behaviour and TTPs | Looks for attack techniques from MITRE ATT&CK and MITRE ATT&CK for ICS | Attackers abusing legitimate tools | Requires deep expertise to build rules |
| Threat intelligence | Matches against indicators such as IP addresses, domains and hashes | Fast recognition of known campaigns | Indicators go stale quickly |
Behavioural detection is becoming more important. With Volt Typhoon, the Chinese state-sponsored group
that the US agency CISA and its partners warned about in May 2023, the attackers relied mainly on built-in
Windows tools such as wmic, ntdsutil, netsh and PowerShell. This
living off the land barely triggers signatures and often stays invisible with default logging
configurations.
🏭 How does OT security monitoring differ from IT?
| Aspect | IT environment | OT environment |
|---|---|---|
| Priority | Confidentiality of data | Availability, integrity and safety of the process |
| Main data source | Endpoint agents (EDR), identity logs | Passive network sensors with protocol analysis (DPI) |
| Network behaviour | Variable, many users and cloud services | Deterministic and real-time, the same connections day in, day out |
| Active scanning | Routine | Risky; older PLCs can fail because of it |
| Access control | Active Directory, Entra ID | Segmentation with VLANs and firewalls, RBAC, physical access |
| Update policy | Regular patches | Strictly controlled, often limited |
| Incident reaction | Isolating a system is standard | Consult operations first; isolation can affect the process |
Because agents on PLCs, HMIs and field devices are usually impossible or not permitted, OT relies on passive monitoring. A sensor receives a copy of the traffic and dissects industrial protocols such as Modbus TCP, OPC UA, GOOSE, DNP3 and S7. Specialised NDR platforms such as Nozomi Guardian, Claroty, the Dragos Platform and Tenable OT Security (formerly Tenable.ot) also use this traffic to build an asset inventory automatically. Open-source alternatives include Zeek, Suricata and Malcolm, an analysis suite from CISA and Idaho National Laboratory.
OT has one big advantage: industrial networks are predictable. A new device, an unknown connection or a program download to a PLC therefore stands out far sooner than it would in an office network.
📊 Which events should you monitor in OT?
| Event | Source | Why it matters |
|---|---|---|
| Program download or mode change of a PLC (for example RUN → STOP or PROGRAM) | Network sensor, Engineering Station | Core of sabotage; rare outside maintenance windows |
| Write commands to controllers from an unknown system | Network sensor | This is how FrostyGoop worked in Lviv |
| New device or new connection in an OT zone | Network sensor, Switch | Rogue laptop, forgotten modem, misconfigured link |
| Changed process parameters or network configuration | Network sensor, configuration logs from switches and firewalls | Sabotage or misconfiguration; compare against planned changes |
| Login via Remote Access outside working hours | VPN, Jump Server | A common entry route in OT incidents |
| Successful and failed logons (Windows events 4624/4625) | HMI, SCADA server, Historian | Password attacks, account misuse |
| New process or new service (4688/7045) | Windows hosts | Malware, persistence, living off the land |
| Cleared security log (1102) | Windows hosts | Almost always a sign of covering tracks |
| Blocked traffic between IT and OT | Firewall, DMZ | Reconnaissance or spread from the office network |
FrostyGoop shows why this matters. In January 2024 this malware sent commands over Modbus TCP on port 502 to the controllers of a district heating company in Lviv, leaving more than 600 apartment buildings without heating for two days. According to the investigation, the attackers may have gained access as early as April 2023 through a vulnerable router. Monitoring for unexpected Modbus write commands and new connections could have raised the alarm during those months.
📜 Which standards and regulations require security monitoring?
- IEC 62443-3-3 - the system requirements call for auditable events (SR 2.8), sufficient audit storage capacity (SR 2.9), reliable timestamps (SR 2.11), accessible audit logs (SR 6.1) and continuous monitoring (SR 6.2). Within the IEC 62443 series, the first three fall under foundational requirement FR 2 Use Control and the last two under FR 6 Timely Response to Events.
- NIST CSF 2.0 - the Detect function consists of Continuous Monitoring (DE.CM) and Adverse Event Analysis (DE.AE).
- NIST SP 800-82 Rev. 3 - NIST’s OT security guide, published in September 2023, covers logging and monitoring with attention to the constraints of OT systems.
- SANS Five ICS Cybersecurity Critical Controls (2022) - ICS network visibility and monitoring is one of the five core controls.
- Cybersecurity Act - the Dutch Cyberbeveiligingswet, which transposes NIS2, has applied since 15 August 2026. Article 8 of the Cybersecurity Decree requires detection, analysis, response and logging of security-relevant events.
- Incident reporting - a significant incident must be reported as an early warning within 24 hours. Without monitoring you often do not even know the clock is running.
For detection rules, MITRE ATT&CK for ICS is the common language; MITRE D3FEND describes the matching defensive techniques. In August 2024, Australia’s ASD and international partners, including CISA and the Netherlands, published the joint guidance Best Practices for Event Logging and Threat Detection, which includes a dedicated section on OT.
🧭 How do you set up OT security monitoring step by step?
- Map assets and data flows - start with an asset inventory and an overview of zones and conduits. You cannot monitor what you do not know.
- Choose sensor locations - place passive sensors on SPAN ports or TAPs at the IT/OT boundary, the SCADA layer and critical process cells. Check that the switches can handle the extra mirroring load.
- Synchronise time - without a single time source via NTP, logs from different systems cannot be correlated.
- Centralise logs - send logs from Windows hosts, firewalls, remote access and the historian to a SIEM outside the process network, for example via the DMZ or a data diode. Anyone who takes over a host can wipe its local logs; central copies survive.
- Start with a few high-value detections - new device, PLC program download, remote access outside working hours, cleared logs. Then expand with threat hunting.
- Write playbooks with operations - agree who may intervene and when. Isolating an HMI can mean operators lose sight of the process.
- Organise staffing - a position staffed 24/7 takes roughly five to six FTE. Many organisations therefore choose an OT SOC or an MSSP for first-line monitoring, while the decision to intervene stays in-house.
- Test and improve - validate detections with a penetration test or attack simulations and measure how long detection and response take.
Apply least privilege to the monitoring environment itself: a SIEM with administrative access to every system is an attractive target. In the Netherlands, CERT-WM is the sector CSIRT for the water boards during an incident; for most other sectors that role belongs to the NCSC.
❓ Frequently asked questions
What is the difference between security monitoring and a SIEM?
Security monitoring is the entire process of collecting, analysing, assessing and responding to events. A SIEM is one tool within it: the platform that stores logs centrally, correlates them and generates alerts. Without analysts, detection rules and playbooks, a SIEM only produces stored data.
Is security monitoring safe for PLCs and other OT systems?
Passive security monitoring is safe for PLCs because the sensor only receives a copy of the network traffic and sends nothing to the controllers. Actively scanning or querying older controllers, however, can cause malfunctions. You should therefore only do that in a controlled way and in agreement with operations.
Is security monitoring mandatory under NIS2 and the Dutch Cybersecurity Act?
The Dutch Cybersecurity Act does not prescribe a specific product, but Article 8 of the Cybersecurity Decree requires detection, analysis and logging of security-relevant events. In addition, a significant incident must be reported within 24 hours. In practice, security monitoring is therefore needed to comply with the law.
How long should you retain security logs?
There is no general legal retention period for security logs; you set it based on your risk assessment and sector rules. Because attackers sometimes stay unnoticed for months, as with FrostyGoop, many organisations keep at least several months of immediately searchable logs plus a longer archive period. Record the chosen period and the reasoning in your policy.
What is the difference between security monitoring and threat hunting?
Security monitoring reacts to alerts that rules and sensors generate automatically. Threat hunting assumes an attacker is already inside without having raised an alarm and actively searches for traces, often based on a hypothesis from threat intelligence. Threat hunting therefore builds on the data that security monitoring collects.
Can a small company outsource security monitoring?
A small or medium-sized company can outsource security monitoring to a managed security service provider or an OT SOC service. The provider then monitors 24/7 and reports suspicious events. Knowledge of the process and the decision to intervene should, however, stay within your own organisation.
📌 In summary
Security monitoring is the continuous collection and analysis of events to discover attacks early; in OT this is done mostly passively, with protocol awareness and without disturbing the process. With passive sensors, central logging, a small set of high-value detections and playbooks written together with operations, you meet IEC 62443 and the Dutch Cybersecurity Act and shorten the time an attacker can stay unseen in your network.