BLUF: AIOps cannot create trustworthy OT evidence from telemetry that is incomplete, semantically ambiguous or time-misaligned. Before correlating alarms or recommending a runbook, build a passive evidence path that records what was observed, when that observation was made, how its time was derived, which asset and zone produced it, and whether the signal was usable. Automation comes after this evidence contract—not before it.
This is not a recommendation to mirror every packet indefinitely. It is a way to decide, per use case, which signals deserve collection, how long their evidence must survive, and when the estate is ready for analytics. NIST SP 800-82 Rev. 3 treats OT as systems with distinct performance, reliability and safety requirements. That is why passive observation and a separate control path matter.
The architecture: evidence before inference
Start with a one-way or tightly governed passive collection path. A network TAP, SPAN source or protocol gateway observes approved OT traffic; collectors normalize records without writing to controllers; a time service and asset/topology registry enrich every record; an immutable evidence store retains raw and normalized forms. The AIOps layer consumes that evidence and produces hypotheses, confidence and a human-readable evidence packet. It does not receive a route to PLC, SIS or actuator commands.
Evidence flow diagram
Passive TAP / protocol gateway → protocol-aware collector → timestamp and quality normalizer → asset + zone context → immutable evidence tiers → AIOps correlation → operator evidence packet → approval-gated runbook. The control path remains separate and is not an output of this pipeline.
The data contract work is foundational. Use the existing industrial AI data-contract pattern to define asset identity, engineering units, state and permitted use before an alert model learns accidental correlations.
What each event must prove
A useful event is more than a value and a timestamp. Preserve: source timestamp; collector receive timestamp; time-source identity and synchronization state; sequence or capture order; protocol and parser version; asset identity; network zone; quality flag; unit/state semantics; collection policy; and a content hash or immutable object reference. Keep the original payload where justified by safety, incident response and data minimisation; keep a normalized representation for correlation.
Why two times? Device time answers when the asset says it observed the condition. Collector time answers when the monitoring estate saw it. If the clock is unsynchronized, the difference is evidence, not a nuisance to overwrite. Record the uncertainty and let correlation windows widen or reject the event rather than manufacturing precision.
Readiness score: a gate, not a maturity theatre
Score each priority use case on five evidence dimensions. A score of 0 means unknown or untested; 1 means present but not measured; 2 means measured and owned. Start advisory correlation only when every safety-relevant dimension is 2 and the total is at least 8/10. Below that, fund observation remediation rather than model tuning.
OT evidence readiness table
| Dimension | 0 — blocked | 1 — partial | 2 — ready | Owner |
|---|---|---|---|---|
| Asset and zone context | source cannot be tied to an asset/zone | inventory exists but stale | owner, asset ID and zone reconciled | OT engineering |
| Time provenance | timestamp origin unknown | NTP/PTP exists without health evidence | source, sync state and measured offset retained | OT platform |
| Protocol quality | opaque or lossy capture | parser has unknown exceptions | protocol-aware parse, quality flags and replay set | automation engineering |
| Retention and replay | no incident evidence | raw or normalized only | tiered retention plus protected replay sample | security operations |
| Collection safety | active polling changes risk | exceptions undocumented | passive path reviewed; control plane isolated | OT security |
Retention tiers should follow the decision
Use a short, high-volume operational tier for normalized telemetry, a longer incident-evidence tier for selected raw captures and enrichment snapshots, and a release-evidence tier for correlation rules, model versions, thresholds and approvals. Retention is a cost and exposure decision: raw data can be valuable in an incident but expensive and sensitive at scale. Define purpose, access and deletion controls with security, operations and privacy stakeholders.
CISA’s guidance on secure AI integration in OT calls for continuous monitoring, validation and refinement of AI models in OT. That is operationally possible only if a flagged recommendation can be replayed against the evidence that existed at the time.
Failure modes that make correlation look smarter than it is
1. Clock drift creates a false causal chain. Mitigation: retain source and receive time, monitor offset, and downgrade or exclude events outside a declared uncertainty bound.
2. Asset identity is reused after a replacement. Mitigation: join stable asset identity, serial/configuration epoch and topology version; do not key history on an IP address alone.
3. A protocol parser silently maps a bad quality code to “good.” Mitigation: preserve native quality, version the parser, replay known captures in CI and alarm on parse fallbacks.
4. SPAN oversubscription drops precisely the burst that matters. Mitigation: measure collector loss, use TAPs where justified, and expose coverage gaps to the analyst rather than imputing observations.
5. An AIOps recommendation becomes an implicit control instruction. Mitigation: keep the observation/inference/control separation described in the OT AI safety boundary; deliver evidence and a bounded runbook to a named approver.
Zero trust applies to telemetry too
Visibility is not permission. CISA’s OT zero-trust guidance emphasizes comprehensive asset visibility, identity and access management, segmentation and layered controls. Give collectors the minimum read scope, make enrichment-service access explicit, segment the evidence store, and log analyst and model access. A broad monitoring account is still a high-value credential.
What this does not solve
An evidence model does not make a legacy process safe, repair missing instrumentation, establish a legal retention period or prove a correlation is causation. It also does not authorize automated remediation. Safety cases, sector obligations, works-council, privacy and retention questions require the responsible legal, safety and governance functions. The engineering recommendation here is narrower: make provenance, uncertainty and access controls testable before deploying AIOps analytics.
A practical first workshop
Choose one repeatable incident class—such as intermittent network loss around a production cell. Map the assets and zones, capture passively, measure timestamp offset and loss, define quality semantics, and replay a known event. Only then set a correlation rule and require operator confirmation. The companion approval-gated industrial AIOps workflow shows where that evidence packet should stop before remediation. If you need an evidence-readiness review, Ade can facilitate a scoped OT observability and AIOps architecture workshop.
Sources
NIST SP 800-82 Rev. 3, Guide to Operational Technology Security
CISA, Principles for the Secure Integration of Artificial Intelligence in Operational Technology
CISA, Adapting Zero Trust Principles to Operational Technology
