Single pane across IT and OT for a multi-site energy utility

The challenge

The utility operated eight generation and distribution sites. The NOC ran two separate monitoring stacks: one for IT infrastructure (servers, network, applications) and one for OT (SCADA, PLCs, field instrumentation). Both screens were visible in the same room but were operated by different teams with different tooling and different escalation paths.

Cross-domain incidents - the most damaging category - required the IT and OT teams to reconstruct a shared timeline from separate logs. Average root-cause determination for cross-domain incidents was 40 minutes. Asset maintenance ran on a time-based schedule, not a condition-based one. The quarterly compliance report pulled from four different systems manually.

The approach

Interwork deployed a unified observability platform built on Prometheus, Grafana, and ELK. OT collection used OPC UA behind a one-way data diode - OT data flows into the IT monitoring layer; no traffic flows back to the OT network. IT metrics and OT tag history merged in a unified time-series store with correlation indexing.

Alert routing was rebuilt with named owners and attached runbooks for every alert that could trigger an on-call page. ServiceNow integration auto-creates incidents with the correct classification and assignment. Asset health scoring from OPC UA tag history generates predictive maintenance tickets before a failure threshold is reached.

The outcomes

• 30% reduction in unplanned downtime across all eight sites within 12 months
• MTTR for P1 incidents reduced by 50% - cross-domain root cause in minutes, not hours
• P1 engineer-on-call acknowledged within 15 minutes for 98% of incidents
• Maintenance calendar shifted from time-based to condition-based across critical assets
• Quarterly compliance report automated - no manual data extraction

The NOC teams - for the first time - were looking at the same screen. Cross-domain incidents became diagnosable without a reconstruction exercise. The maintenance team received predictive tickets before failures occurred rather than reactive alerts after them.