They assume more collection automatically means better security. In practice, ungoverned collection can create cost, latency, and noise without improving detection. The real objective is not to store every byte in the SIEM, but to preserve the right context at the right point in the pipeline so analysts can act on meaningful signal.
Why This Matters for Security Teams
OT telemetry visibility is often treated as a storage problem, but it is really a detection and response design problem. In industrial environments, the wrong telemetry strategy can overload collectors, obscure safety-relevant events, and leave analysts with data that is expensive to retain and difficult to use. Good visibility is not about maximising volume. It is about ensuring the right signals survive each hop from device, to historian, to broker, to SIEM or SOC workflow.
This matters because OT environments have different constraints from enterprise IT: legacy protocols, fragile endpoints, limited maintenance windows, and strict uptime requirements. The security team that copies IT logging patterns into a plant network often ends up with blind spots where they expected coverage. NIST guidance such as NIST SP 800-53 Rev 5 Security and Privacy Controls is useful here because it anchors logging, monitoring, and auditability to control objectives rather than to raw data volume.
Teams also get tripped up by the boundary between operations and security. If telemetry design is not aligned to process safety, incident response, and engineering workflows, the result is often a noisy feed that nobody trusts. In practice, many security teams encounter OT visibility gaps only after a plant issue, unsafe condition, or access anomaly has already occurred, rather than through intentional monitoring design.
How It Works in Practice
Effective OT telemetry visibility starts with deciding what must be observed, where it should be observed, and how much fidelity is needed at each stage. A common pattern is to collect raw signals close to the asset, normalize and enrich them at an intermediate layer, then forward only the context that supports triage, correlation, and evidence retention. That approach reduces noise while preserving the details that matter for investigations.
Practitioners usually separate telemetry into three categories:
- Asset and configuration telemetry, such as firmware version, protocol exposure, and device state.
- Activity telemetry, such as authentication events, command execution, and anomalous process changes.
- Contextual telemetry, such as zone, line, site, maintenance window, and owner metadata.
The objective is to keep enough context to answer security questions quickly. A packet capture may be useful during a targeted investigation, but it is not a substitute for structured event data. Likewise, forwarding every OT event into the SIEM can create a retention and parsing burden that weakens detection rather than improving it. Guidance from CISA ICS Recommended Practices aligns with this operational view because it emphasizes asset visibility, segmentation, and risk-based monitoring in industrial environments.
A practical implementation usually includes alert tuning, protocol-aware parsers, and explicit decisions about what is retained at the edge, what is summarized centrally, and what is escalated to the SOC. Security teams also need ownership rules for telemetry quality, because missing fields, clock drift, and inconsistent tags can make correlation unreliable. Current guidance suggests treating OT telemetry as a governed pipeline, not a passive data dump. These controls tend to break down in brownfield plants with unsupported devices because the asset mix limits what can be instrumented and normalized consistently.
Common Variations and Edge Cases
Tighter telemetry collection often increases operational overhead, requiring organisations to balance visibility against latency, bandwidth, and process stability.
One edge case is environments where deep inspection is technically possible but operationally risky. In those cases, best practice is evolving toward selective capture and event-based enrichment rather than always-on high-volume collection. Another variation appears in regulated sectors where evidence retention is required for investigations or compliance. There, teams may need stronger retention controls, but they still should avoid assuming that longer retention automatically improves detection quality.
There is also no universal standard for the exact telemetry set every OT environment should keep. The right answer depends on asset criticality, safety impact, and whether the organisation is optimising for threat hunting, incident response, or compliance evidence. For cross-domain environments, identity signals matter too: privileged remote access, jump host use, and engineering workstation activity often provide the fastest indicators of compromise. That is where OT visibility intersects with access governance, and why security teams should think in terms of control points rather than just log sources.
Where industrial networks are highly segmented or vendor-managed, telemetry can be fragmented across multiple tools and owners. In those settings, the challenge is less about collection and more about making sure the few trustworthy signals are enriched, time-synchronised, and operationally usable. For broader control mapping, NIST SP 800-53 Rev 5 Security and Privacy Controls remains a practical reference point for logging, monitoring, and accountability.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM | OT telemetry visibility is a monitoring and anomaly detection problem. |
| MITRE ATT&CK | T0859 | Attackers may manipulate OT telemetry or disable visibility to hide actions. |
| NIST SP 800-53 Rev 5 | AU-2 | Audit event selection is central to deciding which OT signals are retained. |
Check whether telemetry gaps could mask adversary actions in the OT environment.
