This was a great debate from S4x18. Many owner / operators have an Enterprise Secure Operations Center (SOC), and they are considering how best to handle OT incident detection and response. There are two main approaches:

1. Add OT data and incident response capabilities to an Enterprise SOC or

2. Set up and run a SOC dedicated to the OT environment

Dan Scali of FireEye took the Enterprise SOC side and debated with Rob Lee of Dragos, who argued the OT SOC side.