Industrial SIEM Assurance Requires Federated Evidence and Plant-Safe Collection

Collecting everything can become an availability risk

A common SIEM design forwards raw logs from every site into a central lake. In OT, WAN capacity is often shared with services that support operation, maintenance and recovery. A noisy device or deliberate event flood can turn monitoring into an availability problem, while aggressive filtering can remove the exact records an investigator later needs. A useful industrial design should explicitly separate local forensic retention from cross-site detection and urgent notification. First classify which records support incident reconstruction, which signals support timely correlation and which events require rapid escalation. Do not assume that a single retention or forwarding policy fits all three purposes.

Keep evidence at the edge with integrity and time context

Edge collectors should retain relevant raw records close to their originating cells, with synchronised time, source identity, bounded local storage and integrity controls. Avoid relying exclusively on the collector's own administrative account to attest the trustworthiness of the records it stores. The central service can ingest derived or selected correlation signals to detect related low-volume behaviour across plants. High-value changes, such as controller logic edits, privilege changes or security-policy modifications, may follow a protected priority path when connectivity permits. These are architectural recommendations; their practical implementation depends on the process network, endpoint capabilities and supported data sources.

A priority channel also needs failure limits

An attacker could generate large volumes of events that the collection policy marks urgent. Without quotas and queue controls, the 'critical' lane becomes another route to exhaust bandwidth or storage. Reserve capacity for high-value evidence, apply bounded forwarding and safe deduplication, and define overflow handling and resynchronisation after WAN loss. Maintain enough local forensic context to reconstruct event sequence even when central alerts are delayed. Test collector restarts, queue exhaustion, dropped telemetry, clock drift and the ability to replay backlogs without affecting deterministic process traffic. A backlog that arrives after recovery is evidence, but it should not be misrepresented as real-time detection.

Federated investigation must not grant control authority

Central analysts may need historical events that were not forwarded. Federated retrieval can provide read-only queries scoped to approved sources, times and fields, while the plant enforces CPU, I/O, bandwidth and query-duration limits. A SIEM administrator should not inherit control permissions on PLCs or engineering workstations just to search logs. Segregate investigation identity from configuration-change authority, approve exceptional remote collection, and record the query and its result. Test a query that would otherwise consume significant resources, including disconnected and degraded-mode sites. If the query can affect production, the architecture has converted visibility into operational authority.

Separate regulatory applicability from evidential value

Draft ETSI EN 304 622's exclusion of industrial OT SIEM from its product scope is not an exemption from the CRA. The applicable product category, intended use, regulatory obligations and availability of cited harmonised standards must be assessed independently. Article 27 of Regulation (EU) 2024/2847 ties presumption of conformity to relevant harmonised references published in the EU Official Journal and only to the requirements covered by them. Until such conditions are met, a draft or vertical standard can inform engineering design but should not be claimed as automatic legal conformity. A defensible evidence packet connects the threat scenarios, requirements, implemented controls, stress-test results, process constraints and residual risk decision.

Related context. Continue with OT governance and risk and monitoring authority.