Context-Enriched Security Monitoring for OT/ICS Networks Using Cloud SIEM and Passive Telemetry

Abstract

The rapid convergence of Information Technology (IT) and Operational Technology (OT), accelerated by Industry 4.0, has increased industrial connectivity and efficiency while simultaneously expanding the attack surface of critical environments. In OT/Industrial Control Systems (ICS) networks, cyber incidents can escalate beyond data loss or financial impact into operational disruption and safety-relevant consequences. At the same time, many industrial organizations face a practical gap between detection and response – i.e., security telemetry may exist, but actionable, context-rich alerting and reliable monitoring of the monitoring system/tool itself are often insufficient. Our work investigates a cloud-based system for security event monitoring and analysis, with a focus on OT/Internet of Things (IoT) environments where passive, agentless visibility is frequently required. The objective is to design and validate an end-to-end approach that: A) centralizes and enriches security events, B) enables rapid, operationally useful notification and triage, C) improves the reliability of visibility through health/operational monitoring, and D) detects high-impact scenarios that are difficult to distinguish using generic alerts, such as firmware downgrade activity camouflaged as legitimate update behavior. Methodologically, our work combines a structured review of OT threat trends and systemic weaknesses – e.g., visibility gaps, segmentation, remote access exposure, and shared credentials - with practical engineering implementations and controlled testing. The developed architecture integrates passive OT monitoring - Microsoft Defender for IoT (D4IoT), cloud SIEM correlation and analytics, - Microsoft Sentinel - and automation workflows (Azure Logic apps). Custom analytic logic is introduced to enrich alerts with operational context (e.g., sensor identity and location) and to implement version-aware comparison for differentiating benign firmware upgrades from potentially malicious downgrades. Reliability is addressed through a multi-layer health monitoring model that independently detects loss of telemetry, cloud connectivity degradation, and sensor availability issues using SIEM rules, Azure Resource Graph checks, and on-premises monitoring (e.g., SNMP/Zabbix), including applicability to constrained or air-gapped scenarios. In addition, a complementary SIEM use case is demonstrated via Splunk-based detection workflows for IoT malware/DDoS-related indicators, illustrating how heterogeneous sources can be unified into a “single pane of glass” for investigation and response. Results from laboratory and production-like validations show that the system can deliver timely, context-rich notifications to security operations, reduce response time, and minimize alert fatigue by selectively escalating only high-risk events (i.e., downgrade incidents) while reporting routine changes (i.e., upgrades) through scheduled summaries. The health monitoring layer provides early warning of visibility degradation and supports guided troubleshooting by differentiating likely failure modes. Collectively, the findings support the conclusion that cloud-based event monitoring - when combined with OT-aware passive telemetry, context enrichment, automation, and reliability monitoring - meaningfully improves detection-to-response effectiveness in Industrial environments without introducing disruptive active scanning or endpoint agents. As external validation of practical impact, one of the authors has received official recognition from Microsoft for contributions to Defender for IoT, including collaboration on a playbook. The link to the recognition will be provided separately.