implementing-dragos-platform-for-ot-monitoring

Deploy one Dragos sensor per monitored segment using a network TAP or SPAN port at OT boundaries, then validate connectivity through the Platform API by checking sensor status, packets per second, and last-seen timestamps. Confirm coverage against your asset inventory rather than relying on a green sensor status alone.

Dragos forwards notifications to Splunk via CEF-formatted syslog on port 514 with a defined severity mapping, or to Microsoft Sentinel through a Syslog-CEF connector writing to a Log Analytics table. Validate forwarding with a synthetic notification rather than generating traffic on the live OT network.

Yes, Dragos detection analytics include threat-group-specific intelligence for VOLTZITE, CHERNOVITE, KAMACITE, ELECTRUM, GRAPHITE, and BAUXITE. Detection of current activity depends on keeping Knowledge Packs updated, so verify auto-update is working and sensors report a recent pack version.

Missing assets usually result from SPAN or TAP coverage gaps, oversubscribed mirror ports dropping packets, or quiet devices that rarely communicate. Passive discovery cannot see silent assets, so use collection or active queries carefully with native protocols only, never active port scans against fragile PLCs.

Do not use Dragos for IT-only network monitoring without ICS components, or as a replacement for endpoint detection and response on OT workstations. Environments already standardized on Claroty or Nozomi should use those platforms' respective tooling instead.