𝗗𝗮𝘆 𝟮𝟴 𝗼𝗳 𝟭𝟬𝟬 𝗗𝗮𝘆𝘀 𝗼𝗳 𝗢𝗧 𝗖𝘆𝗯𝗲𝗿 – 𝗧𝗶𝗺𝗲 𝘁𝗼 𝗗𝗧𝗔 (𝗗𝗲𝗳𝗶𝗻𝗲 𝗧𝗵𝗲 𝗔𝗻𝗼𝗺𝗮𝗹𝘆) You can’t call it “anomalous” if you don’t know what normal looks like. DTA = Define The Anomaly. That means understanding context, protocols, and patterns in your OT environment. Without definition, detection is guesswork.