Critical infrastructure
Threat detection and signed logs for critical infrastructure.
Security for essential services
Essential services need security decisions grounded in operating context. Monitoring in a SIEM connects account and network activity, while a clear evidence record helps the operator decide how to respond without losing sight of service continuity.
Guidance
| Guidance | What it asks | Security support |
|---|---|---|
| Living off the land guide, 2024 | Baselines of tools, accounts and traffic. | Detection baselines per user and host. → |
| Living off the land guide, 2024 | UEBA across multiple data sources. | SIEM UEBA and correlation. → |
| Event logging guide, 2024 | Protect logs from modification and deletion. | Signed, chained logs. → |
| NCSC CAF C1.b | Analysis on copies, master unaltered. | Detection reads a copy of the SIEM export. → |
| NIS2 | Evidence on request. | Case timelines and signed exports. → |
Living off the land
Living-off-the-land attacks use tools that also support legitimate operations. Comparing their use with account and host history, as AI Detection does through UEBA, helps investigators identify unusual activity and test it against approved work.
NCSC CAF C1.b
Protected source records and integrity checks give investigators a reliable basis for review. Analysis on copies helps preserve the original evidence while allowing the team to examine it.
NIS2 Article 23
NIS2 reporting depends on when the organization became aware of a significant incident and how its understanding developed. Retain that timeline, the impact assessment and the decisions needed for each reporting stage.
Telemetry health
Source-health monitoring in a SIEM makes a collection gap visible. Analysts can then judge findings against the data actually available, instead of treating a quiet queue as proof that nothing happened.
By rule
Living off the land guide, 2024
Baselines of tools, accounts and traffic. UEBA baselines in AI Detection add historical context to account and host activity for analyst review.
Living off the land guide, 2024
UEBA across multiple data sources. UEBA baselines in AI Detection add historical context to account and host activity for analyst review.
Event logging guide, 2024
Protect logs from modification and deletion. Signed records from a SIEM and verification material support an independent check of the evidence’s integrity.
NIS2
Evidence on request. A retained incident timeline and protected source records help reviewers follow the evidence and decisions.
Questions
Can we show the regulator a timeline in time?
A maintained incident timeline gives the reporting team a starting point immediately. Keep observations, decisions and unresolved questions together as the investigation develops.
Who approves an action?
The organization defines who may approve each response. A SOAR workflow presents the decision to that person and retains the approval, action and outcome.
What stays with the organization?
The operator retains control-system responsibility, reporting decisions and authority over actions affecting service delivery. Security tools supply evidence and document the response.
Guide
What is NIS2 and who must comply?
NIS2 is the EU cybersecurity directive covering defined essential and important entities. Applicability follows sector, size and national implementation; covered organizations have risk-management and significant-incident reporting duties.
How are living off the land attacks detected?
Attackers living off the land use admin tools that are already installed. AI Detection depends on knowing each account’s normal behavior and flagging what changes.
What logging does critical infrastructure need?
Central, protected logs that show any modification, as the NCSC CAF and joint government guidance recommend.
How ARRTECH takes care of critical infrastructure security
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
