Let’s talk

UK Water Utility

Treat the operational explanation as something to verify

Distinguish OT backup traffic from suspicious activity

Known backup activity provided a possible explanation for the alerts. I compared it with the observed OT activity and previous investigations, then retained the supporting evidence in the incident record.

OT security monitoringMicrosoft SentinelClarotyIncident responseTelemetry requirementsIncident lifecycle engineering
Return to the full story ←

Your exploration

Viewed history

Saved only in this browser.

Ask my portfolio

Ask about my work.

Ask about an investigation, a technology or my contribution. Answers link to the relevant case and technical detail.

Every answer links to the work.
How this works

When AI is connected, your question, recent questions and relevant published pages are sent to MiniMax to select supporting passages. Otherwise, this searches the site directly. Answers quote the saved website and link to their sources. This website does not save chat transcripts. Clearing or leaving the page clears this conversation.

Help improve this website

Report an issue

Spotted something broken or inaccurate? Tell me what happened and what you expected.

English letters and spaces only. Spell out numbers and omit punctuation or links. The current page is attached automatically. Please do not include personal or confidential information.

Reports are private. A browser cookie and a protected network identifier limit submissions to one per browser and IP each UTC day. No name or email is collected.