Industrial XDR architecture for a SOC
Designing and integrating detection components for a large industrial environment, balancing SOC needs and operational constraints.
01 / Context
Context
Security architecture work within a project team for a large industrial customer. The goal was to coordinate detection components and their integration with an internal SOC. Details are intentionally anonymized.
02 / My role
My role
Lead information security engineer / architect at Informzaschita, responsible for architecture, technical documentation, design work and implementation support.
03 / Approach
Approach
- 01
Map SOC requirements, network segments and telemetry collection points.
- 02
Design the KATA / KEDR / NDR integration and its relationship with other controls.
- 03
Account for future separation and migration of security components, including industrial segments.
- 04
Validate integration, document the design and support implementation teams.
04 / Deliverables & contribution
Deliverables & contribution
- Architecture and project documentation for the KATA/KEDR/NDR environment.
- Participation in the deployment and configuration of security components.
- An architecture designed with future OT/SOC evolution in mind.
05 / Disclosure boundary
Disclosure boundary
Customer name, network diagrams, configurations, indicators and operational parameters are withheld. The visual is a conceptual illustration, not a reproduction of a production system.