In OT, log the IT to OT boundary, remote access sessions, engineering connections to controllers, controller logic changes, and any clearing of logs. Store them centrally, restrict who can edit them, and keep them long enough to cover slow intrusions. CISA advisories name each of these.
Why logging matters more than it looks
Some intrusions use legitimate tools and valid accounts. The Volt Typhoon advisory says actors rely on built in tools, avoid triggering alerts and delete logs selectively, and that some victims hosted footholds for at least five years. You find that kind of activity in records, not in a malware alert.
The list
Boundary and access.
- Firewall, VPN and gateway logs for every connection between IT and OT.
- Authentication logs for remote access, including failures. The Unitronics advisory recommends monitoring for unusual logins and unexpected protocols.
- Access logs from bastion or jump hosts.
Engineering activity.
- Connections to controllers from engineering workstations, which the Siemens S7 alert asks owners to log.
- Unauthorised write operations on controller memory, such as S7comm writes.
- Use of unexpected programming libraries on non-engineering machines.
Controller integrity.
- Logic changes and mode changes, compared with a baseline.
- Firmware changes.
Hosts.
- Security and application logs on engineering workstations and servers.
- Process creation and unusual driver loads, as AA22-103A suggests for management systems.
Log integrity.
- Alert on log clearing. The Volt Typhoon advisory says to investigate every event showing a cleared log.
- Use file integrity monitoring.
Where logs should live
Centralise them, for example in a SIEM, and restrict who can access or modify them, as the Volt Typhoon advisory recommends. Keep a copy outside the OT network where possible, so an intruder in the plant cannot erase the evidence.
Retention
The advisory says to retain logs for a period based on risk or regulatory requirements. Because dwell time can be long, choose the longest period you can afford for boundary and authentication logs, and a shorter one for noisy sources.
Baselines and tuning
Record what normal looks like: which workstations talk to which controllers, at what hours, using which protocols. The agencies advise baselining ICS operations and traffic and tuning alerts to reduce noise while still firing on high risk activity. Alert fatigue defeats the purpose.
Start small
If you have little today, begin with the IT to OT firewall and the remote access gateway. Those two sources cover the paths agencies describe most often. Add engineering workstations next, then controllers.
Quick check
Do I need an OT specific monitoring product?
Not to begin. Boundary and remote access logs, centralised and retained, give much of the value. ICS aware detection is an addition the agencies recommend later.
Why alert on cleared logs?
Clearing logs is a known concealment tactic, so each case deserves investigation.
Sources
- CISA, Volt Typhoon advisory AA24-038A
- CISA, IRGC-Affiliated Cyber Actors Exploit PLCs, AA23-335A
- CISA, Defending Against an Active Threat to Siemens S7 Series PLCs, AA26-231A
- CISA, APT Cyber Tools Targeting ICS/SCADA Devices, AA22-103A
Last reviewed: 19 October 2026.
