A global mining company closed the visibility gap across its ICS/OT networks

A global leader in mining and commodities, this company runs mines and processing facilities worldwide. Those sites depend on Industrial Control Systems (ICS) and Operational Technology (OT) to automate heavy equipment, processing plants, and safety systems — including SCADA software and the programmable logic controllers (PLCs) that run conveyors and ventilation.

That estate grew over time into a mix of modern and legacy systems across many locations, and as IT and OT converged it became harder to secure. A compromised ICS can mean operational disruption, financial loss, and safety hazards, so the company made OT security a priority. The core problem was that its OT infrastructure had no centralized logging. Every mine and processing plant generated logs — SCADA alarms, Windows-based HMI event logs, PLC status messages — but they sat siloed on local systems in different formats and locations. Some SCADA components wrote to text files, others to proprietary databases, and many critical events were only visible on the local operator station.

The company could still operate this way, but it could not aggregate or analyze OT security events centrally, which left it without a clear view of the plant floor and made real-time threat detection close to impossible. Compliance was the second pressure point: standards like ISA/IEC 62443 call for a centrally managed, system-wide audit trail with reliable timestamps, and this setup could not produce system-wide, time-correlated logs. Audit preparation meant collecting evidence by hand — slow, and easy to get wrong.

The company deployed NXLog Platform across its mining operations as a single logging and monitoring layer, rolling it out in the heterogeneous OT environment during planned maintenance windows to avoid disruption.

NXLog Agent was installed on the Windows-based SCADA and HMI servers to read native Windows Event Logs, capturing PLC communications, operator actions, and system alerts. Where systems produced log files or proprietary text output, the im_file input module was configured to tail, read, and process those files in real time, and NXLog Agent’s database inputs covered the SCADA components that logged to proprietary databases instead of files.

NXLog Agent could also collect telemetry from industrial devices and protocols that previously had no oversight at all. Using passive network capture through the im_pcap module, it listened to OT network traffic and decoded common ICS protocols including Modbus, DNP3, BACnet, and Siemens S7. That meant even PLC-to-PLC communications and sensor data crossing the network could be logged and analyzed, giving the company much deeper insight into its process control communications.

The deployment was tailored to the company’s distributed and air-gapped sites. NXLog Platform is vendor-agnostic and runs across hybrid, on-premises, and air-gapped environments, so agents at remote mines worked without internet access or extra dependencies, and OT data stayed inside each site’s security perimeter. Where bandwidth was constrained, NXLog Agent forwarded events in compressed batches to keep network impact low — useful for remote sites backhauling to a central data center over cellular links. Built-in buffering and failover handled connection loss: if the link to the central repository or SIEM went down, logs queued locally and forwarded automatically once it came back, so audit data was not lost. Collected OT logs were normalized (converting proprietary ICS events into JSON or syslog) and routed to Microsoft Sentinel alongside critical IT logs, so analysts could see OT and IT events in the same dashboards and correlate threats across the enterprise. Custom parsing let the team write rules for OT-specific anomalies — for example, flagging rarely used control commands appearing on the network.