Planning a threat hunting strategy is essential for proactively searching for threats and vulnerabilities in the OT environment before they manifest into attacks.
Evaluating what can go wrong before it happens is a core part of risk assessment, involving the identification and analysis of potential risks and their impacts on OT systems.
Implementing strategies to automatically bring PLCs offline is generally not a responsible or safe approach in OT environments because it could disrupt critical industrial processes.
Creating disaster recovery plans is important for overall business continuity but is not primarily a task of auditors during risk assessment-it is more of a broader business continuity or incident response responsibility.

Fine-tuning event handling for specific sensors in FortiSIEM is done within the rule configuration, where conditions, thresholds, and logic are adjusted to control how events are generated and processed.

FortiAnalyzer is designed to collect and process logs from devices in the OT network, such as PLCs and RTUs, to provide actionable insights. By receiving and analyzing these log messages, FortiAnalyzer helps OT administrators troubleshoot and diagnose issues in the network. This includes identifying abnormal behavior, performance issues, or security threats, which are critical for maintaining the operational integrity and reliability of the OT environment.

The topology shows two detected devices grouped behind LAN (port5), which indicates device detection is enabled on port5 of the Edge-FortiGate. It also shows FortiAnalyzer linked directly only to the Edge-FortiGate, not as a separate Security Fabric member connected to the downstream FortiGates.