CRITICAL INFRASTRUCTURE
Bring every system in your OT and IT estate into one pipeline
NXLog Platform collects from the whole critical-infrastructure estate: PLCs and RTUs, SCADA and HMI hosts, engineering workstations, and the Windows, Linux, and Unix systems around them, including the legacy platforms modern agents will not install on. Process and reduce at the source, store and search locally, and route to the SIEM or historian you already run. It works the same way whether a zone is connected, segmented, or fully isolated with no outbound path.
THE CHALLENGE
Critical infrastructure runs on the systems most monitoring tools were never built to see
The estate is older and more mixed than any vendor demo.
HMIs and engineering workstations run Windows versions that shipped a decade or more ago. Historians and process systems sit on AIX or Solaris. Field devices speak Modbus, DNP3, PROFINET, IEC 60870-5-104, and IEC 61850, protocols designed when these networks were assumed to be closed. Modern agents either will not install on those systems or cannot read those protocols, so the oldest and most safety-critical parts of the plant end up the least monitored.
IT and OT converged. The tooling did not.
Control networks that were once separate now share identity, remote access, and data flows with the corporate estate. The SOC is accountable for both but sees them through different tools, in different formats, with different retention. An incident that crosses the boundary gets reconstructed by hand, at the moment when speed matters most.
Regulation keeps adding monitoring obligations inside the perimeter.
NERC CIP-007 requires security event logging for systems inside the electronic security perimeter, and CIP-015-1 adds internal network security monitoring of east-west traffic, with compliance dates of October 1, 2028 and October 1, 2030. IEC 62443 and NIS2 push in the same direction. That means more collection, more analysis, and more retention, in exactly the places where it is hardest to run anything.
Segmentation breaks tools that assume connectivity.
Control networks are segmented by design, and some zones have no outbound path at all. Plenty of tools quietly assume they can reach a license server, an update channel, a cloud console, or a threat feed. Inside a segmented zone that turns a deployment into a project and leaves features half working.
THE SOLUTION
One pipeline across IT, OT, and everything in between
NXLog Platform collects from every source in the estate, parses and enriches at the source, stores and searches locally, and routes what each destination needs. One agent covers Windows, Linux, macOS, BSD, AIX, and Solaris, down to platforms that shipped twenty years ago, and passive protocol monitoring covers the field devices that cannot log for themselves. The SOC gets one view of IT and OT instead of two partial ones.
It runs the same way wherever your segmentation puts it. In a connected zone it forwards to your SIEM in real time. In a segmented zone it stores and searches locally and exports on your terms. In a fully isolated zone it deploys, licenses, updates, and operates with no outbound connection at all. And because collection is vendor-neutral, this is additive to the SIEM and historian you already run, not a rip-and-replace.
KEY FEATURES & BENEFITS
What it takes to cover a critical-infrastructure estate
Six capabilities that decide whether a monitoring tool covers this estate or only the parts that resemble a corporate network.
01One agent across IT, OT, and legacy
- Windows from Windows 2000 onward, plus Linux, macOS, BSD, AIX, and Solaris on x64, x86, ARM, PowerPC, and SPARC.
- The HMIs, engineering workstations, and process systems that modern agents refuse to install on are covered by the same agent as everything else.
02Collection from ICS and SCADA sources
- SCADA application logs from files and databases, PLC and RTU audit events over syslog, Windows Event Log and Active Directory data, and firewall and switch logs.
- Passive network monitoring for Modbus TCP, DNP3, PROFINET, IEC 60870-5-104, and IEC 61850, so devices that cannot log for themselves are still visible.
03Process and reduce at the source
- Parse, filter, enrich, and reformat before data leaves the system it came from.
- Forward the security-relevant events to the SIEM and keep the full-fidelity record where retention policy wants it, so indexing cost tracks value rather than volume.
04Store, search, and investigate locally
- High-compression storage with real-time full-text and SQL-like search, saved searches, and custom dashboards.
- An incident in the OT segment can be investigated in the OT segment, without waiting on an export to a system the site cannot reach.
05Vendor-neutral routing
- Route processed data to more than one destination at once: the local SIEM or historian, the corporate SOC, and long-term retention.
- Change SIEM vendors later without re-instrumenting the plant.
06Fleet management at scale
- Up to 100,000 agents per node from a self-hosted console, with auto-enrollment, configuration templates, and role-based access control.
- Manage a multi-site estate from one console where the network allows it, or run a separate instance inside an isolated zone. No cloud control plane in either case.
Put it in front of your hardest source
Book a demo and bring the twenty-year-old HMI, or the protocol nothing else reads. We will show you what comes back. Or start free and try it yourself.
DEPLOYMENT
Runs where your network puts it
Critical infrastructure is segmented, and every operator draws the lines differently: VLANs and routing, a one-way data diode, or a zone with no path out at all. NXLog Platform is deployed to fit the model you already have, as one instance or several, so your network architecture does not have to decide your tooling.
Connected zones
Forward to your SIEM, historian, or cloud destination in real time, with buffering and disk-backed queues so nothing is lost when an upstream receiver is unreachable.
Segmented zones
Store and search locally inside the zone, and export a filtered, structured feed to the corporate SOC across the path your change control already approves, including collection through a one-way data diode.
Fully isolated and air-gapped zones
Run a dedicated instance inside the zone. Deploy, license, update, and operate with no outbound connection required. Nothing calls home, so there is no exception to write into the register, and license renewal is a person moving a file.
COMPLIANCE
What the frameworks ask for, and where NXLog fits
NXLog supports the logging, monitoring, and evidence side of these requirements. It does not make an organization compliant on its own, and nothing here is legal advice.
- NERC CIP-007 (Security Event Monitoring). Requires logging of security events for BES Cyber Systems inside the electronic security perimeter. NXLog collects those events from the systems in scope and retains them locally, in a form an auditor can be shown.
- NERC CIP-015-1 (Internal Network Security Monitoring). Approved by FERC in Order No. 907 on June 26, 2025 and effective September 2, 2025. It applies to high impact BES Cyber Systems and to medium impact BES Cyber Systems with external routable connectivity, inside the electronic security perimeter. Compliance phases in by location: October 1, 2028 for applicable systems at Control Centers and backup Control Centers, and October 1, 2030 for all other applicable systems. The standard calls for monitoring east-west traffic inside the perimeter, which means more collection and analysis inside the enclave. NXLog provides that collection layer and keeps the evidence where the systems are.
- IEC 62443 (ISA/IEC 62443). SR 2.8 (auditable events) and SR 6.2 (continuous monitoring) call for centralized audit trails and ongoing monitoring of the industrial automation and control system. NXLog centralizes those audit trails within the zone.
- NIS2 (EU). Operators of essential services in energy, transport, and water carry detection, handling, and reporting obligations. Complete, timestamped telemetry from both the IT and the OT side is what makes incident reconstruction and reporting possible.
NXLog Platform is proven in critical infrastructure
NXLog Platform free tier was considered for PoC phase and finally full-featured NXLog solution has been chosen for production deployment because of its manageability and scalability. One of the strong points of NXLog to highlight is its configuration granularity and filtration abilities that allowed us to ingest only valuable events resulting in expenditure saving on EPS volume
Also running in (published case studies, anonymized at customer request)
- Worldwide oil and gas operator. Real-time industrial process control across global facilities, meeting NIS2, IEC 62443, and ISO 27001 requirements across OT and IT. Read the case study
- Global energy company. Gas and liquid pipelines plus power generation across Canada, the US, and Mexico. Read the case study
- Mining industry leader. An ICS and OT estate spanning modern and legacy systems across multiple sites. Read the case study
Where it fits
Energy & utilities
Monitoring inside the perimeter before the CIP-015 dates.
IT/OT convergence
One SOC timeline across both estates.
Plants & substations
Telemetry out of a segmented site without opening it.
Legacy & OT
Coverage for the systems no modern agent supports.
GET STARTED
See it on your own estate
We will map your estate, IT and OT, to what the pipeline collects, filters, and forwards. Bring your segmentation model and your compliance obligations and we will show where each one lands, including the zones with no outbound path. Or start free and deploy it yourself.
Follow us
© Copyright NXLog Ltd.