An essential function of industrial control systems is monitoring the operation of automated processes. They issue warnings if a fill level falls below a certain threshold or temperatures or valve positions deviate from their norms, for example. The supporting IT infrastructure, on the other hand, is often not sufficiently monitored.

If unusual or security-relevant events in such operational environments are monitored inadequately (or not at all), attempted attacks, network bottlenecks, or foreseeable failures cannot be detected at an early stage. Moreover, poor evaluation or unclear presentation of the events may also lead to warnings and errors being detected too late.