skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-ics-asset-discovery-with-claroty

Discover and inventory ICS/OT assets using Claroty xDome passive monitoring and Edge active queries.

954|172|Updated Mar 13, 2026
Search Tags:#asset-discovery#SCADA#ot-security#ICS#claroty#iec62443#xdome
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-ics-asset-discovery-with-claroty
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-ics-asset-discovery-with-claroty
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/ot-ics-security/performing-ics-asset-discovery-with-claroty
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-ics-asset-discovery-with-claroty

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests.

What problem does it solve?

Industrial environments often lack accurate asset inventories, making IEC 62443 risk assessments and OT security monitoring impossible. This Skill provides a structured workflow to gain full visibility into PLCs, RTUs, HMIs, and network infrastructure using the Claroty xDome platform.

Core Features & Use Cases

  • Passive Network Monitoring: Configure Claroty sensors on SPAN ports to observe OT traffic without impacting operations, then export inventories via the xDome API.
  • Safe Active Discovery: Use Claroty Edge native protocol queries (Siemens S7, CIP, Modbus, BACnet) with rate limiting and SIS exclusion to enrich asset details during maintenance windows.
  • Validation & Enrichment: Cross-reference discovered assets against CMDB records to find shadow OT devices and check firmware against NVD vulnerability data.
  • Use Case: A manufacturing plant preparing for an IEC 62443 assessment runs 2-4 weeks of passive monitoring, schedules Edge active queries in a maintenance window, and produces a Purdue Model asset distribution report with risk scores.

Quick Start

Ask the AI to generate a Claroty xDome asset discovery plan and Python reporting script for your OT site, including passive sensor setup, Edge active query configuration, and a Purdue-level inventory report.

Frequently Asked Questions about performing-ics-asset-discovery-with-claroty

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I discover ICS assets with Claroty xDome?▼

Deploy Claroty sensors on SPAN ports for passive monitoring of OT traffic, then use the xDome API to retrieve and export discovered assets. Supplement with Claroty Edge active queries using native protocols like S7, CIP, and Modbus during maintenance windows.

How to safely run active discovery on PLC networks?▼

Use Claroty Edge native protocol queries (S7 SZL read on TCP 102, CIP Identity on 44818, Modbus FC43 on 502) instead of IT scanners like Nessus or nmap. Rate-limit to about 10 packets per second, schedule in maintenance windows, and exclude SIS subnets.

Can I use Nessus or nmap to scan OT networks?▼

No, active IT vulnerability scanners can crash legacy PLCs and RTUs at Purdue Levels 0-1. Use passive monitoring plus Claroty Edge native protocol queries, which are designed to be safe for industrial devices.

Why does passive monitoring miss some OT assets?▼

Passive monitoring only sees devices that communicate, so standby PLCs, serial devices behind gateways, or rarely-talking IEDs never appear on the SPAN. Confirm completeness against P&ID drawings, switch MAC tables, and scheduled active queries.

What are shadow OT devices and how do I find them?▼

Shadow OT devices are assets connected to the control network but missing from the CMDB. Find them by diffing the Claroty-discovered inventory against CMDB records by IP address, and correlate MAC/serial numbers to catch dual-homed hosts.

When should I not use Claroty for asset discovery?▼

Do not use it for IT-only asset discovery (use Nessus or Qualys instead), for active scanning of sensitive PLC networks without vendor approval, or in environments where Claroty is not the deployed platform.

Related Skills

Explore More Software Engineering Skills→
cropsggcropsgg
15

plan-eng-review

Review multi-service plans for architecture, data flow, edge cases, and test coverage.

Community
Advanced
drupadsachaniadrupadsachania

operational-technology

Automate OT/ICS risk assessment, asset discovery, and security governance.

Community
Advanced
DCx7C5DCx7C5

asset-SKILL.md

Score asset criticality across six factors and map tiers to remediation SLAs.

Community
Advanced
dgethingsdgethings

radkit-remote-access

Provides cloud-relayed remote access to network devices via RADKit for CLI and SNMP.

Community
Advanced