OT SOC & Detection Engineering: Industrial Threat Detection, SIEM, Network Monitoring, ATT&CK for ICS, Hunting and Incident Triage

A state actor lived in critical infrastructure for five years and left no malware. What exactly is your SOC watching?An enterprise SOC pointed at a plant is watching the wrong network. Operational technology speaks different protocols, cannot tolerate active scanning, and fails in physical ways an IT analyst has never been trained to see. Volt Typhoon's five-year, malware-free intrusion is the proof: detection of tools is not detection of trust. This is the build manual for a SOC that can watch a plant without ever endangering it.This build manual teaches you to: - Design sensor architecture and protocol visibility for OT- Engineer a SIEM and choose the log sources worth collecting- Use MITRE ATT&CK for ICS as a live detection map- Run the detection-engineering lifecycle, threat hunting and purple teaming- Triage without disruption and measure coverage on a 24x7 modelWho it's for: OT SOC analysts, detection engineers, threat hunters, and security operations leaders.Every chapter opens on a real, dated, documented incident and closes with a one-line Boardroom Intelligence takeaway a director can act on. A full Source-Notes appendix lets every claim be checked."You cannot respond to what you cannot see."About the author Professor Kai London (CISSP, CISM) is an internationally recognised cybersecurity executive, board advisor and author with 25+ years defending banking, aviation, defence, government and critical national infrastructure.This single, exhaustively engineered reference is built to replace an entire shelf of vendor manuals and generic SIEM primers - every chapter, detection rule, and triage runbook is designed for immediate use by working OT SOC and threat-hunting teams, making it the highest-value, most complete investment a plant, utility, or security program can make in ATT&CK-for-ICS detection engineering.