Because the security value of OT data depends on context that must be present before retention decisions are made. If enrichment happens after ingestion, the SIEM has already billed the event and the analyst still has to reconstruct meaning later. In-stream enrichment changes the economics and the detection outcome at the same time.
Why pre-ingestion enrichment changes the economics of OT telemetry
Industrial telemetry is rarely useful as raw signal alone. Context such as asset type, tag meaning, site, process unit, and normal operating envelope turns events into decisions. If that enrichment is delayed until after ingestion, the platform stores and bills unprioritised data first, then asks analysts to reconstruct meaning later. That reverses the order in which detection value is created.
In practice, pre-ingestion enrichment lets you decide earlier what deserves retention, indexing, alerting, or suppression. It is not just a convenience layer. It is part of how OT data becomes security-relevant, because context determines whether a telemetry point is noise, a maintenance event, or a sign of process deviation.
For industrial environments, that matters because the same signal can mean very different things depending on where it came from and what machine or process generated it. A pressure change on one line may be routine, while the same pattern on another line can indicate malfunction, unsafe operation, or manipulation. Enrichment before storage gives detection logic a better chance to separate those cases at scale.
What changes when context arrives before the SIEM
Pre-ingestion enrichment changes the pipeline, not just the dashboard. When tags, asset identity, site context, and process metadata are attached before the SIEM or data lake sees the event, correlation rules can operate on something meaningful immediately. That reduces the need for manual triage work that would otherwise happen after storage, search, and review costs have already been incurred.
It also improves downstream control decisions. Filtering, routing, and retention policies can be applied using business meaning instead of raw protocol fields alone. That is especially important for OT data because high-volume telemetry streams can create expensive blind spots if teams retain everything equally and hope later investigation will sort it out.
Pre-ingestion enrichment is strongest when it uses stable references, not fragile analyst assumptions. The point is to encode the asset and process truth once, close to the data source, so every later consumer sees the same interpretation. NIST SP 800-82 Rev 3, OT Security Guide is useful here because it frames industrial monitoring around architecture, segmentation, and control-system realities rather than generic IT log handling. CISA Industrial Control Systems resources serve the same purpose when teams need operational guidance for critical infrastructure telemetry and monitoring.
Why enrichment is also a security control, not just a data pipeline choice
When telemetry is enriched before ingestion, security teams can detect abnormal behaviour earlier and with fewer false positives. That matters in OT because delayed interpretation can let a small anomaly look like ordinary noise until it has already blended into the baseline. Earlier context also helps preserve evidence quality, since the event arrives with the metadata needed to explain why it mattered in the first place.
This is also where adversary tradecraft becomes relevant. Attackers often benefit from ambiguity, especially in environments where devices, tags, and protocols are hard to interpret at speed. If a team enriches telemetry only after ingestion, the attacker gains time while defenders spend cycles reconstructing intent. If the context is attached up front, the defender has a better chance of spotting lateral movement, unsafe command patterns, or abnormal device interactions before the signal disappears into volume.
Pre-ingestion enrichment does not eliminate the need for good detection engineering, but it materially improves the inputs to it. That is the security reason the pattern matters: it narrows ambiguity before the event becomes expensive, persistent, and harder to interpret. MITRE ATT&CK Enterprise Matrix helps teams think about attack behaviour, while NIST Cybersecurity Framework 2.0 provides the broader govern, identify, detect, respond structure that fits this kind of telemetry improvement.
Risk and Threat Considerations
When enrichment is late or inconsistent, industrial telemetry can become expensive to store and weak to investigate. The immediate risk is not only higher SIEM cost, but also delayed detection, because the original context needed to interpret the signal was never attached at the point where it could still shape routing and retention.
Failure mechanism: Raw OT events are ingested first, then enriched later or manually, which means alerting, search, and retention decisions are made before the event has meaningful context. That creates avoidable blind spots and makes it easier for an attacker or process fault to hide in high-volume noise.
Impact: Teams pay to store and process low-value data, analysts spend more time reconstructing meaning, and genuinely important deviations can be detected too late or dismissed too easily. In an OT setting, that can delay response to unsafe conditions, unauthorised activity, or process drift.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-3 — Content of Audit Records | OT telemetry needs context in records to support meaningful detection and investigation. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Pre-ingestion enrichment improves the quality of records reviewed and correlated for detection. | |
| SI-4 — System Monitoring | Industrial telemetry enrichment strengthens monitoring by making events interpretable in real time. | |
| Recommendation — Capture the context needed for security analysis before logs are stored and searched. Use contextual enrichment to improve log analysis and alert triage. Feed enriched telemetry into monitoring so anomalies can be detected earlier. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitor for anomalous activity and indicators of compromise | The question is about improving detection outcome through better telemetry context. |
| GV.RM-01 — Risk management strategy is established and agreed to by organizational stakeholders | Retention and enrichment timing affect operational and security risk trade-offs. | |
| ID.AM-02 — Hardware and software assets are inventoried | Asset and process context are central inputs to meaningful OT telemetry enrichment. | |
| Recommendation — Monitor enriched OT data to improve anomaly detection and response speed. Define how early enrichment supports risk-based retention and detection decisions. Maintain an accurate asset inventory so telemetry can be enriched before ingestion. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | The subject concerns making telemetry more useful for logging, retention, and analysis. |
| CIS-13 — Network Monitoring and Defense | Enriched OT telemetry improves monitoring fidelity and incident detection. | |
| Recommendation — Store logs with context that supports investigation and retention decisions. Tune monitoring rules using enriched industrial telemetry instead of raw events alone. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | If industrial telemetry includes access logs or control-plane events, context helps surface misuse of exposed secrets. |
| Recommendation — Use contextual logging to spot secret abuse in telemetry pipelines sooner. | ||
Practitioner Guidance
What to prioritise: Enrich at the edge or stream layer with the minimum context needed to make immediate routing and retention decisions, especially asset identity, site, and process role. If that context cannot be trusted, fix the source-of-truth problem before relying on downstream analytics.
What to verify: Confirm that the enriched fields are stable, consistently populated, and available to the detection stack before the event is stored. If analysts still need to cross-reference separate inventories for routine interpretation, the enrichment model is not yet doing its job.
Practitioner takeaway: The goal is not to enrich everything, but to attach the right operational meaning early enough that security decisions, and the costs behind them, are made with context instead of guesswork.