A multinational oil and gas operator built one telemetry pipeline across its OT and IT networks

Real-time industrial process control leaves little room for error, and this operator runs it across production sites in several countries. Each site is segmented according to the Purdue Model, with firewalls between layers and cross-zone communication deliberately restricted. That design protects the process. It also makes getting logs out of the protected OT zones difficult.

The sources were varied. Windows and Linux systems, PLCs, SCADA and HMI stations, firewalls, and data historians all produced telemetry in different shapes. A large number of legacy field devices produced almost no log data, or emitted events in non-standard formats, or could not run an agent at all.

Regulation added a deadline to the work. The operator has to satisfy the EU NIS2 directive along with IEC 62443 and ISO 27001, which means demonstrating consistent collection and retention rather than describing an intention to collect.

Volume was the fourth constraint. Sending everything from every site to a central SIEM would have driven ingest costs up and buried the events the security team actually needed. The team had to collect and centralize more, while sending less.

The operator deployed NXLog Platform in a tiered agent-and-relay architecture that follows the site's existing segmentation instead of cutting across it.

•  At the edge. NXLog agents run in the OT field and control layers (Purdue Levels 0–2), reading Windows Event Log with im_msvistalog and local application logs with im_file. Where legacy controllers and PLCs could not host an agent or generate logs at all, im_pcap captures the industrial traffic passively — including Siemens S7, Modbus, and DNP3.

•  Filtering at the source. Agents apply regular-expression filtering and parsing before anything leaves the site, discarding noise and irrelevant events. Whatever survives is compressed and sent onward in encrypted batches with om_batchcompress.

•  A controlled crossing point. Relay servers in the industrial DMZ — the tier often called Layer 3.5 — receive those batches with im_batchcompress, decompress and inspect them, then route in two directions at once: one stream to a local ELK stack for on-site monitoring, one copy to local storage as a forensic archive. If the link upward drops, the site keeps its own record and the retention obligation still holds.

•  Into the SIEMs. From the DMZ, a further relay forwards consolidated logs to the enterprise IT and cloud layer (Purdue Levels 4–5), normalizing them into JSON, XML, or CSV with xm_json, xm_xml, and xm_csv on the way. Both SIEMs — IBM QRadar on premises and Microsoft Sentinel in the cloud — receive data in the shape they expect.

NXLog Platform manages the whole estate from one place: uniform configuration pushed to every agent, health monitoring on each agent and relay, and an audit trail of collection activity. For a network spread across countries and split into zones, that central control is what makes the architecture administrable rather than just technically possible.