# Which OT alerts matter most for a small factory?

The ones that mean something changed in the process: a write or program download from an unexpected computer, a controller being stopped, started or switched to another mode, office traffic reaching the control level, and any of this outside working hours. These are rare in normal operation, so each one deserves a call to the person responsible for the line. Alerts about volume or new destinations matter too, but on the IT side, where most attacks on factories start. Agree in advance who receives OT alerts, how quickly someone looks, and that nobody disconnects a production host without asking the shift lead, because an abrupt disconnection can cost more than the alert. From the Pro plan, NetSenX raises exactly these OT alerts: unauthorised writes, traffic crossing plant network levels, off-hours OT activity and S7comm commands, next to the beaconing, scanning, lateral movement and unusual outbound volume alerts it raises on every plan.

FAQ: [OT and IoT](https://netsenx.com/en/faq/ot) · https://netsenx.com/en/faq/which-ot-alerts-matter-most-for-a-small-factory

## Read next

- https://netsenx.com/en/ot-network-monitoring
- https://netsenx.com/en/compare

## Related questions

- [How do I detect a PLC program change outside working hours?](https://netsenx.com/en/faq/how-to-detect-a-plc-program-change-outside-working-hours)
- [Can network monitoring see an S7 PLC being stopped?](https://netsenx.com/en/faq/can-network-monitoring-see-an-s7-plc-being-stopped)
- [Can network monitoring show who changed a PLC setpoint?](https://netsenx.com/en/faq/can-network-monitoring-show-who-changed-a-plc-setpoint)
- [Does NetSenX record the values written to our controllers?](https://netsenx.com/en/faq/does-netsenx-record-the-values-written-to-controllers)
- [Can OT alerts help a quality or safety investigation?](https://netsenx.com/en/faq/can-ot-write-events-support-a-quality-or-safety-investigation)