A computer-implemented method for logging and monitoring kernel-level events in an industrial control system, comprising: loading a logging agent to a kernel of an operating system executing on a first computing device (140, 146, 148) of the industrial control system, the logging agent being configured to detect kernel-level events occurring at the first computing device (140, 146, 148), and the operating system being configured to define a kernel space and a user space of the first computing device (140, 146, 148); detecting a kernel-level event, at the first computing device (140, 146, 148), using the logging agent loaded to the kernel, the kernel-level event being characterized by an attribute, and the kernel-level event being detected in the kernel space; the method being characterized by: determining whether the detected kernel-level event satisfies a monitoring condition, the monitoring condition identifying at least one kernel-level event to log, and the determination being performed in the user space; in response to determining that the detected kernel-level event satisfies the monitoring condition, generating a log record that encapsulates the detected kernel-level event and the attribute, and the log record being generated in the user space; and transmitting the generated log record from the user space, wherein, upon receiving the log record, the detected kernel-level event and the attribute are combined with one or more other log records from one or more second computing devices (140, 146, 148) into a time-ordered event data stream configured to be evaluated by a remote server. loading a logging agent to a kernel of an operating system executing on a first computing device (140, 146, 148) of the industrial control system, the logging agent being configured to detect kernel-level events occurring at the first computing device (140, 146, 148), and the operating system being configured to define a kernel space and a user space of the first computing device (140, 146, 148); detecting a kernel-level event, at the first computing device (140, 146, 148), using the logging agent loaded to the kernel, the kernel-level event being characterized by an attribute, and the kernel-level event being detected in the kernel space; the method being characterized by: determining whether the detected kernel-level event satisfies a monitoring condition, the monitoring condition identifying at least one kernel-level event to log, and the determination being performed in the user space; in response to determining that the detected kernel-level event satisfies the monitoring condition, generating a log record that encapsulates the detected kernel-level event and the attribute, and the log record being generated in the user space; and transmitting the generated log record from the user space, wherein, upon receiving the log record, the detected kernel-level event and the attribute are combined with one or more other log records from one or more second computing devices (140, 146, 148) into a time-ordered event data stream configured to be evaluated by a remote server. determining whether the detected kernel-level event satisfies a monitoring condition, the monitoring condition identifying at least one kernel-level event to log, and the determination being performed in the user space; in response to determining that the detected kernel-level event satisfies the monitoring condition, generating a log record that encapsulates the detected kernel-level event and the attribute, and the log record being generated in the user space; and transmitting the generated log record from the user space, wherein, upon receiving the log record, the detected kernel-level event and the attribute are combined with one or more other log records from one or more second computing devices (140, 146, 148) into a time-ordered event data stream configured to be evaluated by a remote server.