# Can OT alerts help a quality or safety investigation?

Yes, as one source of evidence among several. An OT alert tells you that a controller received a write from a host that is not allowed to write, or an S7comm command, or traffic outside working hours, with the source host, the controller and the time. Put it on a timeline next to the historian data, the HMI audit trail, the shift log and the maintenance records, and you can usually narrow down when and from where a change came. Make sure the clocks agree, because a few minutes of drift between systems makes timelines misleading. Note what alerts do not cover: an authorised write during the shift raises no alert, so the HMI trail stays your record of everyday changes. NetSenX keeps alerts for your plan's alert history; you read them in the dashboard, through the API from the Pro plan, or in your SIEM from the Business plan. They contain no written values and name no person.

FAQ: [OT and IoT](https://netsenx.com/en/faq/ot) · https://netsenx.com/en/faq/can-ot-write-events-support-a-quality-or-safety-investigation

## Read next

- https://netsenx.com/en/ot-network-monitoring
- https://netsenx.com/en/compare

## Related questions

- [Does NetSenX raise a separate anomaly alert for each industrial protocol?](https://netsenx.com/en/faq/does-netsenx-raise-a-separate-alert-for-each-industrial-protocol)
- [Can NetSenX block a dangerous command to a PLC?](https://netsenx.com/en/faq/can-netsenx-block-a-dangerous-command-to-a-plc)
- [Does NetSenX read PROFINET, OPC UA or IEC 60870-5-104?](https://netsenx.com/en/faq/does-netsenx-read-profinet-or-opc-ua)
- [Can a network sensor see serial fieldbus links such as Modbus RTU?](https://netsenx.com/en/faq/can-a-network-sensor-see-serial-fieldbus-links)
- [What does "never actively probed" mean for our controllers?](https://netsenx.com/en/faq/what-does-never-actively-probed-mean-for-our-controllers)