OT and IoT
OT monitoring tools that watch a protocol the agent cannot take (2026)
A 2026 shortlist of watchers for plants and protocols. Public docs, not a lab bake-off.
Expertise: OT and IoT · Level: Intermediate · 12 min read
A weekly EDR agent is not a PLC plan.
The controller cannot run CrowdStrike. The protocol is not HTTP. OT monitoring is a span and a parser. Endpoint owns the laptop. Network owns the enterprise path. This page is the plant.
Six watchers. Two open engines. One SOC bundle. Three industrial shelves. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| Malcolm | Open ICS-friendly traffic analysis | BSD-3-Clause (see repo) |
| Zeek | The language for the span | BSD-3-Clause |
| Security Onion | SOC bundle that can sit on a span | GPL-2.0 |
| Nozomi Networks | Known OT visibility shelf | Commercial |
| Claroty | Known OT security platform | Commercial |
| Dragos | Known OT threat monitoring | Commercial |
Malcolm
Best for open ICS-friendly traffic analysis
Malcolm is INL’s traffic analysis bundle with ICS-friendly pieces. Open. You operate it.
Key features
- Packet analysis bundle
- ICS-aware docs
- You host it
- Open license
Why we like it
Hidden gem. A plant that cannot buy Dragos this year can still parse a span.
Limits
You staff it. Not a 24/7 MDR contract. No exploit guide.
Zeek
Best for the language for the span
Zeek is the network analysis language. Not OT-only. You write scripts for the protocol you actually have.
Key features
- Protocol parsers
- Script language
- BSD
- Huge community
Why we like it
If Malcolm or Onion is the bundle, Zeek is often the brain. Name it.
Limits
You write the script. Not a plant vendor. Not EDR.
Security Onion
Best for sOC bundle that can sit on a span
Security Onion is on the SIEM list. Here it is the bundle you can point at a tap. Overlap declared.
Key features
- Zeek Suricata Elastic
- You operate it
- Hunt UIs
- GPL
Why we like it
If the SOC already runs Onion, ask for an OT tap before a fourth console.
Limits
You staff the cluster. Not a Claroty replacement in a quarter. Link SIEM.
Nozomi Networks
Best for known OT visibility shelf
Nozomi sells OT and IoT visibility. Known industrial shelf.
Key features
- Protocol visibility they document
- Asset inventory stories
- Enterprise
- Commercial
Why we like it
Steering-committee name in plants.
Limits
Commercial. We did not run a sensor. No payload content.
Claroty
Best for known OT security platform
Claroty is the other known industrial name. xDome and neighbors on their current site.
Key features
- Asset and threat stories they publish
- Enterprise
- Commercial
- OT-first marketing
Why we like it
Second known shelf so the page is not one logo.
Limits
Commercial. We did not run it.
Dragos
Best for known OT threat monitoring
Dragos sells OT threat monitoring and intel. Known in critical infrastructure conversations.
Key features
- OT detections they document
- Intel add-on
- Commercial
- Plant-shaped
Why we like it
Third known shelf. Intel is their pitch. We do not recap it as a score.
Limits
Commercial. We did not run a site. Defense only.
What the internet thinks about OT monitoring
Zeek threads treat scripts as the way to see a protocol. We keep OT on that side of the line: parse, do not exploit.
tptacek on Hacker News, Apr 2020: “Zeek is an intrusion detection system that analyzes debugging traces to generate usefully semantic data, ranging from which hosts are fetching this URL to signs of a vulnerability being exploited.”
Prove Malcolm still has a tree
Confirm Malcolm still publishes. Do not span a plant you do not operate.
curl -fsSIL https://github.com/idaholab/Malcolm | head -n 6FAQs
Can I put EDR on the PLC?
Usually no. That is why this pillar exists. Endpoint owns the laptop in the cabin.
Is this a SIEM list?
No. Onion appears because it can sit on a tap. The SIEM list is the console job.
Will you publish protocol attack steps?
No. Defense and parsers only.
Is this a scored bake-off?
No. Order is editorial.
