Corelight ICS Collection is a network visibility solution designed for monitoring Industrial Control System (ICS) and Operational Technology (OT) environments. The product identifies and logs ICS/OT protocols including BACnet, DNP3, Ethercat, Ethernet/IP, CIP, Modbus, PROFINET, S7Comm, and TDS. The solution leverages Zeek network security monitoring framework and protocol analyzer plugins to generate detailed logs for enabled protocols. It identifies new services in connection logs in real-time, providing visibility into network communication and behavior patterns. The ICS Collection monitors activity related to HVAC systems, security cameras, smart lighting, and access control systems. It detects uncommon network behavior and identifies anomalies in enterprise and operational network traffic. The product is delivered as part of Corelight's Open NDR Platform and can be activated based on organizational needs. The collection includes contributions from the Cybersecurity and Infrastructure Security Agency (CISA). Organizations can use the ICS Collection to discover ICS/OT devices, capture protocol-specific evidence, and reduce incident response times by monitoring for unusual network interactions across factory floors and enterprise IT networks.