OT observability · A VIEOX perspective
OT observability: give industrial monitoring context.
Connect industrial monitoring, equipment events and operating context so production, quality, engineering and security teams can examine the right evidence.
The practical question
What does OT observability mean for an industrial team?
In this series, OT observability means the ability to investigate equipment and process behaviour through connected measurements, events and operating context. The goal is to make useful questions answerable and information gaps visible. It complements established monitoring and specialist judgement; a view of the operation does not authorise control actions.
An operation can have dashboards, alarms and a historian yet still require several people to reconstruct an unfamiliar event. OT observability begins with that gap: can the available information help a responsible team understand what happened, where it happened and what still needs explanation?
Begin with the question behind the screen
Choose an investigation that currently requires several systems or conversations. A changed cycle, an unexpected quality finding or an equipment alert may each need a different combination of records. Identify the person who needs the answer and what a clearer understanding would help them decide.
A useful view should make the relevant scope obvious. Readers need to know which equipment, product and period they are examining. Information that is accurate in isolation can still be misleading when shown against the wrong operating context.
Connect information with the purpose of the operation
NIST’s performance-assurance research describes the collection, analysis and distribution of manufacturing information as part of evaluating system performance. For an observability discussion, that provides a useful reference point: choose information because it helps examine the intended work, then evaluate whether the resulting view supports that examination.
Sources: [1]
Keep monitoring and investigation connected
A configured monitor can tell a team when a defined condition is present. An unfamiliar pattern may need a wider review: what was running, which earlier events matter, whether a value is current and what changed elsewhere. Keep the alert connected to enough context for that next question.
Preserve uncertainty. A missing update should remain distinguishable from a measured zero, and a suspect time relationship should not become a confident sequence. The ability to see the limits of the information is part of understanding the operation.
Give human observations a useful place
An operator’s note, a maintenance finding or a quality disposition may explain something the signals do not describe. Attach the account to its equipment and period, identify its source and allow it to be reviewed. Do not turn an interpretation into a measured fact by placing it on the same screen.
Hypothetical example: a temperature change appears after a line restart. The shift note records a different product and an extended warm-up. The combined record creates a more specific question for the process specialist than the temperature trace alone.
Keep each discipline’s responsibility clear
Operational visibility and cybersecurity monitoring can use some related information, but they serve different questions. A production investigation does not replace security monitoring, and a security alert does not by itself explain a quality result. Establish how the responsible teams will share relevant findings.
Likewise, keep visibility separate from permission to operate, adjust or maintain equipment. Existing operating procedures and authorised specialists determine the response. The information view should help those people understand the situation and preserve the reasons for their decisions.
Give industrial security data its operating context
Industrial security data can include access events, configuration changes and application logs. NIST’s OT logging guidance recommends device, time and account context, time correlation, and consideration of performance and storage impacts.
An approved configuration change may help explain a changed signal during production. Keep the security event, maintenance authorisation and operating observation distinct, with appropriate access and responsible owners. A coincident event is a lead for review; it does not establish an intrusion or explain a production fault by itself.
Sources: [2]
Evaluate one investigation from beginning to end
Ask whether a colleague can move from the initial concern to the relevant period, trace the information to its source, identify missing context and record a useful next step. Observe which parts still require manual reconstruction. That is a practical basis for prioritising better information.
For VIEOX, the conversation starts with the work people need to understand. Bring an investigation that is repeatedly difficult despite the systems already in place. We can explore the information boundary and what a more useful account would need to include.
Put the question to work
A practical checklist
- Choose an investigation and identify who needs the answer.
- Show equipment, product, period and operating mode.
- Keep source, freshness and missing information visible.
- Connect specialist and operator observations with their context.
- Evaluate whether the view supports a clearly owned next step.
Questions, answered
Is OT observability another name for collecting every signal?
No. The useful scope depends on the questions, permissions and operating constraints. Start with information that can support a defined investigation and expand when a demonstrated gap justifies the effort.
Does observability replace a SCADA system or historian?
This perspective concerns how operating information becomes understandable across a review. The role of any existing SCADA system, historian or other platform should be considered within the site’s architecture and responsibilities; a new information view does not automatically replace it.