OT Monitoring for Industrial Networks and Critical Infrastructure

“Zicht op uw OT-netwerk en grip op cyberrisico’s met open-source oplossingen”

More and more organizations are facing increasing cyber threats, stricter laws and regulations such as NIS2, and a growing reliance on industrial automation. At the same time, many organizations have limited visibility into their OT networks, assets, and communication patterns. Without this visibility, it becomes difficult to detect anomalies, vulnerabilities, and cyber incidents in a timely manner and investigate them effectively.
To help organizations gain insight into their OT environment, OTconnect has developed the Malcolm OT Monitoring Introduction Training. This hands-on, one-day training course introduces participants to the world of OT network monitoring using Malcolm, a powerful open-source platform for OT visibility, network analysis, and security monitoring.

Training and Practical Environment

During the training, participants will learn how to visualize OT network traffic, how to automatically discover assets, and how to identify anomalous communication patterns. In addition, participants will be introduced to tools such as Malcolm Dashboards, Arkime, and NetBox, and will learn how to use them for OT monitoring and incident analysis.
The training is conducted in Dutch. The training materials are available in English and can also be provided in Dutch upon request.
The training can be taken at an OTconnect training location or as an in-company training session at your own organization. The training utilizes a realistic OT lab environment with simulated OT traffic and industrial protocols such as Modbus, OPC-UA, Siemens S7, and Ethernet/IP.

Doelgroep

This accessible training course has been developed for organizations that manage, maintain, or secure OT networks and want to get started with OT monitoring and OT visibility.

The training is suitable for

  • SOC analysts
  • OT operators
  • OT Engineers
  • Maintenance Engineers
  • OT Consultants
  • Security professionals
  • IT administrators
  • Industrial Network Administrators
  • Organizations Preparing for NIS2

No specific prior knowledge of Malcolm is required. A basic understanding of networks and industrial automation is a plus.

Practical Component

The training combines theory with hands-on exercises. Approximately 40% of the training consists of theory and 60% of practical exercises. Participants work in an OTconnect lab environment where they perform their own analyses on realistic OT datasets and industrial protocols.

During the labs, topics such as asset discovery, Modbus analysis, PLC scanning, shadow assets, and incident analysis are covered. This provides immediate insight into how Malcolm can be used in practice for OT monitoring and OT security.

Training Program

Introduction to OT Monitoring

  • OT vs. IT
  • Why OT Monitoring Is Important
  • Current Threats in OT Environments
  • OT Visibility as the Foundation for Cyber Resilience

Sensor Placement

  • Sensor Placement Within OT Networks
  • Purdue Model
  • TAP vs. SPAN
  • Monitoring of Critical Network Segments
  • Common Design Choices

Malcolm Dashboards

  • Introduction to Malcolm
  • Using Dashboards
  • Insight into Assets and Communication
  • Interpreting Security Alerts

NetBox & Asset Context

  • Asset Discovery
  • Asset Visibility
  • Enrichment of OT Network Data
  • Detecting Unknown Assets

Arkime

  • Historical Network Analysis
  • Explore Sessions
  • Searching for Unusual Communication
  • Support for Incident Investigations

Incident Analysis

  • Investigations into Suspicious Incidents
  • Analysis of OT Network Traffic
  • Using the asset context
  • Practical OT Security Use Cases

Result

Benefits

After the event, the participant can

Using Malcolm for OT monitoring

Interpreting Dashboards

Analyzing OT Network Traffic

Providing Insight into Assets and Communication

Performing Basic Threat Hunting

Investigating Incidents

Evaluate Sensor Placement

Using NetBox for Asset Visibility and Context

All the benefits at a glance

An Accessible Introduction to OT Monitoring and OT Visibility

Hands-on training with realistic OT use cases

Practical knowledge for industrial networks

Understanding Assets, Communication, and Cyber Risks

Support for NIS2-related monitoring objectives

Hands-on experience with Malcolm, Arkime, and NetBox

No expensive licenses thanks to open-source technology

Ready for immediate use in water, energy, infrastructure, and manufacturing environments

In addition, participants have gained experience with realistic OT use cases, making the knowledge they have acquired immediately applicable in operational OT environments.

Certificate of Participation

Upon completion of the training, each participant will receive an official certificate of participation from the OTconnect Academy.
There is no exam. The focus of this training is on acquiring practical knowledge and skills that can be immediately applied in operational OT environments.

In-Company Training

The Malcolm OT Monitoring Fundamentals training course is available both as an individual course and as an in-company training session.
When multiple employees within the same organization are involved in OT management, OT security, or OT monitoring, an in-company training session can offer an efficient solution. This approach also allows us to address your organization’s specific OT environment, architecture, and challenges.

Benefits of In-Company Training

Integration with Your Own OT Environment

Training Multiple Employees at the Same Time

Ability to address your own use cases

Practical discussions about your own challenges

Increased effectiveness through immediate applicability