it necessary to implement novel and robust security measures [3]. As most critical infrastructures, the water domain relies on industrial protocols (e.g., Modbus, OPC, Powerlink, DNP3) in their communications, with a myriad of security limitations, among which we can highlight the following [4, 5, 6, 7, 8, 9]:  
* Lack of authentication mechanism, making it possible for an attacker to enter the system by creating a packet with a valid address, a function code and any associated data. * Absence of encryption used in the communication messages, making it possible for an attacker to sniff all communications between masters and slaves. * No Broadcast suppression, making it possible for an attacker to create flooding conditions in all network addresses. * No checksum, making it possible for an attacker to spoof packets. In addition, the water sector is exposed to a wide number of IT challenges that go from the cooperation and alignment between physical and cyber security teams to the proliferation of new vulnerabilities and complex cyber-attacks with potential disastrous consequences, which results into a strong demand of cross-knowledge activities involving awareness and training of cyber-physical security related aspects in the water sector [10, 11, 12]. In this order of ideas, the water domain does not have specific cybersecurity plans to address unique risks or particular conditions, and as such, the following gaps have been detected [13, 14, 15]:  
* Huge gap between IT professionals and end users that makes is difficult to trace any systematic training program;
* Discrepancies on the National cybersecurity strategies among EU member States;
* Lack of systematic cooperation with non-governmental entities and public-private partnerships;
* Need for common standards, semantics, and processes implemented in inter-operable solutions;
* Shortage of qualified technical personnel;
* Lack of awareness in cybersecurity aspects;
* Poor bilateral and multilateral collaborations;
* Lack of trust among organizations. Considering the above-mentioned limitations, challenges and gaps of the water sector, it is imperative the development of solutions to improve cyber and physical security mechanisms in the area. We present in this paper a Cross-Layer Analytic Platform (hereinafter denoted as CLAP), developed for the correlation of Cyber and Physical security events affecting water CIs. CLAP is used to simulate attacks against a victim machine emulating a water CI with PLCs, and security tools (e.g., intrusion detection systems, SIEMs, access control mechanisms, network traffic analyzers, and tools to detect anomalous events in real time). The contributions of this article are summarized as follows:  
* A Data Analytic platform that integrates various tools for the detection of cyber and physical attacks in critical infrastructures;
* The combination of cross-layer data sources to improve detection mechanisms;
* A process that correlates relevant security data coming from cyber and physical sensors through specific detection and monitoring systems;
* An automated process that maps correlated security events with standardized threat categories and/or attack patterns;
* The deployment of the platform over multiple attack scenarios. The ultimate goal of the platform is to improve the detection of complex attack scenarios in real time based on the correlation of cyber and physical security events affecting critical infrastructures, as well as to assign appropriate severity values to each correlated alarm that will guide security analysts in the decision-making process to prioritize their mitigation actions. The remainder of this paper is structured as follows: Section 2 presents related work regarding cyber and physical security platforms. Section 3 describes the architecture of our proposed CLAP solution. Section 4 details the correlation process used to assign severity levels to the correlated events as well as the sharing mechanisms used by the proposed platform.