Converged SIEM Framework for Unified IT-OT Security Monitoring

Abstract

Critical infrastructure security has traditionally maintained a rigid separation between Information Technology and Operational Technology systems, creating dangerous blind spots that sophisticated threat actors increasingly exploit. This article presents a unified Security Information and Event Management framework that integrates telemetry from hardened endpoints, network firewalls, and industrial IoT sensors into a single correlation engine designed specifically for cyber-physical systems. The proposed architecture addresses the fundamental challenges of converged IT-OT security monitoring through three core pillars: standardized data ingestion accommodating heterogeneous protocols, normalized event processing establishing consistent taxonomies across domains, and cross-domain correlation logic capable of identifying sophisticated multi-stage attacks. By leveraging machine learning approaches, including convolutional neural networks and behavioral analytics, the framework enables the detection of subtle anomalies and previously unknown attack patterns while maintaining low false positive rates that minimize operational disruptions. The research demonstrates how automated asset discovery addresses the persistent challenge of shadow IT and unmanaged operational devices in dynamic industrial environments, while security orchestration and automated response capabilities streamline incident management workflows. Cross-domain context enrichment proves particularly valuable during incident response, revealing how digital compromises affect physical operations and ensuring that containment actions align with operational safety requirements. This converged approach provides comprehensive real-time visibility across the entire cyber-physical ecosystem, enabling security teams to detect threats that span both digital and physical realms, significantly reducing response times while accounting for the unique characteristics of operational technology environments, including deterministic timing requirements, legacy equipment constraints, and safety-critical operational continuity demands.