SIEM log source coverage analysis, detection rule audit, and gap remediation roadmap for [REDACTED] running Splunk Enterprise. Covering 127 required log source types, OT integration, and 204 active detection rules. Engagement ref. ENG-2025-0562.
Plaidnox conducted a comprehensive SIEM gap analysis for [REDACTED]'s Splunk Enterprise deployment. Of 127 required log source types identified for the energy sector threat model, only 52 (41%) are currently ingesting into Splunk. Zero OT/ICS log sources are connected, leaving the control network entirely outside SIEM visibility despite 14 NIS2-adjacent requirements for OT security monitoring.
Of 204 active detection rules, 47 are stale (last triggered over 90 days ago and likely misaligned with current log schema), and 38 critical MITRE ATT&CK techniques relevant to energy sector adversaries have no detection coverage.
| Category | Required | Active | Coverage | Risk |
|---|---|---|---|---|
| Windows Event Logs | 18 | 16 | 89% | Good |
| Network / Firewall | 14 | 11 | 79% | Medium |
| Cloud (Azure) | 22 | 8 | 36% | High |
| Email / Collaboration | 8 | 4 | 50% | Medium |
| OT / ICS / SCADA | 31 | 0 | 0% | Critical |
| Endpoint (EDR) | 12 | 9 | 75% | Medium |
| IAM / PAM | 22 | 4 | 18% | High |
| ID | Finding | Priority |
|---|---|---|
| SIEM-G01 | 0 OT/ICS log sources . entire control network blind to SIEM; NIS2 Article 21 compliance risk | Critical |
| SIEM-G02 | 47 stale detection rules . last fired 90+ days ago with no rule review process | High |
| SIEM-G03 | 38 energy-sector ATT&CK techniques uncovered (T0800, T0881, T0843, T0846 etc.) | High |
| SIEM-G04 | Azure activity logs only 36% coverage . cloud pivot attacks undetectable | High |
| SIEM-G05 | No Splunk SOAR integration . all triage and response is manual, inflating MTTR | Medium |
| Action | Timeline | Owner |
|---|---|---|
| Deploy Splunk OT Security add-on and connect 6 OSIsoft PI / Ignition log sources | Wk 1-6 | Plaidnox / OT Team |
| Audit and retire 47 stale detection rules; replace with Splunk ES Content Update | Wk 1-4 | Plaidnox |
| Map and deploy 38 missing MITRE ATT&CK detection use cases (energy sector) | Wk 4-12 | Plaidnox |
| Extend Azure connector to cover Entra ID, Defender for Cloud, Key Vault audit logs | Wk 2-5 | Plaidnox / IT |
| Implement Splunk SOAR for automated triage of high-volume low-fidelity alerts | Wk 6-14 | Plaidnox |