diff --git a/content/nim/security-monitoring/ngf-security-events.md b/content/nim/security-monitoring/ngf-security-events.md
index f79c9316e..a01d30fa8 100644
--- a/content/nim/security-monitoring/ngf-security-events.md
+++ b/content/nim/security-monitoring/ngf-security-events.md
@@ -33,6 +33,62 @@ This integration covers security event visibility only. NGINX Instance Manager c
 - NGINX Gateway Fabric running F5 WAF for NGINX with NGINX Agent v3, connected to NGINX Instance Manager. See [Connect NGINX Gateway Fabric to NGINX Instance Manager]({{< ref "/nim/connect-kubernetes/connect-ngf.md" >}}).
 - Security Monitoring turned on in NGINX Instance Manager
 
+## Configure NGINX Instance Manager
+
+Before NGINX Gateway Fabric can send security events to NGINX Instance Manager, configure NGINX Instance Manager to receive them.
+
+### Enable the OpenTelemetry collector
+
+NGINX Instance Manager uses an embedded OpenTelemetry (OTel) collector to receive security events from NGINX Gateway Fabric over gRPC.
+
+1. Open `/etc/nms/nms.conf` and set `collector_config.enable` to `true`:
+
+   ```yaml
+   collector_config:
+     enable: true
+   ```
+
+2. Create the OTel collector configuration file at `/etc/nms/otel-collector-config.yaml`:
+
+   ```yaml
+   receivers:
+     otlp:
+       protocols:
+         grpc:
+           endpoint: "0.0.0.0:4317"
+         http:
+           endpoint: "0.0.0.0:4318"
+
+   processors:
+     batch:
+       send_batch_size: 500
+       timeout: 2s
+     secevt: {}
+
+   exporters:
+     debug:
+       verbosity: normal
+
+   service:
+     pipelines:
+       logs:
+         receivers: [otlp]
+         processors: [batch, secevt]
+         exporters: [debug]
+   ```
+
+3. Restart the NGINX Instance Manager service to apply the changes:
+
+   ```shell
+   sudo systemctl restart nms
+   ```
+
+### Verify network access
+
+Confirm NGINX Instance Manager is reachable from the Kubernetes cluster on port `4317` (gRPC). NGINX Gateway Fabric sends security events to this port.
+
+---
+
 ## Set up event export from NGINX Gateway Fabric
 
 NGINX Gateway Fabric generates and exports security events. NGINX Instance Manager doesn't pull or request them. Configure the export on the NGINX Gateway Fabric side.
diff --git a/content/nim/security-monitoring/troubleshooting.md b/content/nim/security-monitoring/troubleshooting.md
index 6684c4b41..013bcdfa8 100644
--- a/content/nim/security-monitoring/troubleshooting.md
+++ b/content/nim/security-monitoring/troubleshooting.md
@@ -51,19 +51,21 @@ If NGINX Instance Manager doesn't receive security events from a NGINX Gateway F
 
 ### Resolution
 
-Check the following on NGINX Instance Manager, in order:
+First, make sure you've completed all NIM-side setup steps described in [Configure NGINX Instance Manager]({{< ref "/nim/security-monitoring/ngf-security-events.md#configure-nginx-instance-manager" >}}), including enabling the OpenTelemetry collector and creating the collector configuration file.
+
+Then check the following on NGINX Instance Manager, in order:
 
 1. Confirm the embedded OpenTelemetry collector is turned on. In `nms.conf`, verify `collector_config.enable` is set to `true`:
 
    ```yaml
-      collector_config:
-         enable: true
+   collector_config:
+     enable: true
    ```
 
    If you change this setting, restart the service:
 
    ```shell
-      sudo systemctl restart nms
+   sudo systemctl restart nms
    ```
 
 2. Confirm NGINX Instance Manager is reachable from the Kubernetes cluster on port `4317` (gRPC).