Operational technology (OT) is the hardware and software that monitors and controls physical infrastructure (pumps, valves, signals, building systems). 

Informational technology (IT)  is the hardware and software supporting  agencies in investigating incidents, coordinating response, and measuring performance (identity, endpoint security, network security, analytics platforms). 

When OT and IT data remain separated, agencies lose the context needed to act quickly and safely.

This article explains a practical way to bridge OT and IT data with Elastic, so you can move from isolated sensor readings to a unified operational view with searchable, governed, real-time operational insight.

IT and OT convergence is the shift away from treating operational technology and information technology as separate domains with separate ownership and toward a model where data, tools, and processes flow between them as one system.

For decades, agencies ran OT and IT as parallel worlds with different teams, different budgets, and different vendors. That separation made sense when OT systems were closed and physically isolated. It makes far less sense today, when a traffic signal controller, a water treatment sensor, and a city laptop can all sit on the same network path. 

IT and OT data convergence becomes even more important as organizations adopt AI. The value AI delivers is greater when it has context from unified data and can support teams with a unified operational picture and a better understanding of what is happening across the systems that run the city.

Elastic reduces protocol sprawl by using a single ingestion architecture, the Elastic Agent managed by Fleet, to normalize data from legacy industrial protocols and modern IoT sources into Elastic Cloud.

As a result, with Elastic, data from a decades-old valve controller can be indexed and explored with the same consistency as telemetry from a modern IoT sensor, so teams spend less time translating formats and more time resolving issues. 

It also improves interoperability by giving legacy and modern systems a common data layer, making it easier to connect systems across different protocols, vendors, and generations of infrastructure.

While many OT protocols are manufacturer-specific, the true challenge for municipalities is long-term interoperability, ensuring that data remains accessible regardless of which hardware vendor provided the sensor.

Standards like Modbus, PROFINET, and DNP3 typically operate within closed ecosystems. This siloed approach creates significant friction when agencies attempt to integrate new hardware, rotate vendors, or consolidate telemetry into a single operational view.

To counter this, the industry is shifting toward vendor-neutral frameworks. For instance, OPC UA provides a common interface for cross-manufacturer communication. Agencies should apply this same logic to their analytics platforms: adopting a vendor-agnostic, open architectural layer that resides above device-specific protocols to maintain flexibility.

In this environment, open standards, Elastic Agent, and Fleet serve as the interoperability plane. Whether data originates from an MQTT broker or a legacy gateway, it is normalized into a unified schema in Elastic Cloud. This ensures that swapping hardware providers doesn't force a total rebuild of your Kibana dashboards or ML jobs, providing a practical defense against vendor lock-in.

Agencies can quantify impact through faster troubleshooting, fewer blind spots, and earlier detection of operational anomalies (like leaks), especially when OT and IT signals are searchable together. Although use cases may vary depending on organizational needs, these outcomes are already being realized by organizations using Elastic in different operational contexts.

• Challenge: Limited real-time visibility across distribution networks can delay leak detection and increase non-revenue water.
• Value: With high-volume telemetry searchable in near real time using piped ES|QL queries, teams can identify anomalies sooner, prioritize field response, and validate remediation faster.
• Read the full customer story.

• Challenge: High transaction volumes and variable demand can create intermittent performance problems that are hard to pinpoint.
• Value: Unified observability lets teams correlate app/server behavior with infrastructure signals and user-impact metrics.
• Read the full customer story.

Almost every smart city data point already has a location attached to it. Elasticsearch stores that location natively as geo_point or geo_shape data, and Kibana Maps turns it into a layer agencies can search, filter, and correlate in real time.

A water pressure reading, a traffic signal fault, and a security alert on a substation network all mean more when you know where they happened relative to each other. Treating location as a first-class field, not an afterthought bolted on in a separate GIS tool, is part of what makes an OT/IT unification strategy actually usable day to day.

• Asset and vehicle tracking: Follow a transit vehicle, maintenance truck, or drone inspection route over time.
• Density and hotspot analysis: Identify clusters such as leak reports or a parking demand hotspot.
• Location-aware search: Combine location with other data to find events within a specific area and timeframe.
• Security correlation: Enrich network events with location, which lets analysts see whether unusual OT network activity is coming from a location that makes sense for that facility.

While strict air-gapping remains a requirement for highly sensitive federal and defense infrastructure, many municipal agencies are intentionally connecting everyday operational systems to power modern smart city services. However, when OT becomes reachable from IT networks, the attack surface expands, and the blast radius can move beyond data loss into physical service disruption.

This is why guidance from organizations such as CISA and NIST emphasizes securing OT environments while accounting for their unique operational and safety requirements.

Whether you maintain strictly isolated environments or are embracing IT/OT convergence, Elastic Security supports an OT-aware approach. You can secure connected city infrastructure by applying Zero Trust, correlating IT and OT events to detect lateral movement, and using protocol-aware detections mapped to MITRE ATT&CK® for ICS.

Attackers often start in IT (phishing, stolen credentials) and pivot toward OT. When OT and IT telemetry land in one platform, analysts can:

• Investigate a phishing-driven endpoint event

• Track identity and authentication activity

• Correlate network behaviors and OT-side command anomalies

• Build a single timeline that reduces handoffs between tools

• Use AI-driven capabilities to automatically summarize complex IT/OT attack chains

Instead of treating OT traffic as opaque, agencies can enrich and analyze it:

• Decode and analyze industrial protocols (e.g., Modbus, DNP3, and CIP) to identify suspicious commands

• Alert on behavior that’s unusual for a device, time, or segment (e.g., administrative writes at abnormal hours)

• Reduce false positives by pairing network detections with asset and identity context

Mapping detections to MITRE ATT&CK for ICS helps teams:

• Align detection coverage to known tactics and techniques

• Communicate risk in a common language across leadership and technical teams

• Prioritize gaps based on real adversary behaviors

As smart cities bring more OT, IT, and IoT data together, Elastic can help agencies build a more connected operational view, detect anomalies, strengthen security across their infrastructure, and reduce tool sprawl. You can start by setting up the MQTT integration to bring OT data into Elastic, use machine learning for anomaly detection to identify unusual patterns in city sensor data, and explore Elastic Security to help protect industrial and OT environments.