Dragos Platform
You can integrate the Dragos Platform with Sophos XDR so that it sends data to Sophos for analysis.
This page gives you an overview of the integration.
Dragos Platform product overview
The Dragos Platform is an OT and ICS cybersecurity platform that provides visibility and monitoring of operational technology environments for asset identification, vulnerability management, and threat detection, with native support for a broad range of industrial control system protocols.
What we ingest
Sophos XDR collects Dragos Platform data by listening for syslog messages your Dragos deployment forwards to a Sophos XDR data collector. The following log categories are collected:
- Security alerts: Dragos Platform alerts (all alert types).
Event and data types
We ingest the following event and data types from the Dragos Platform:
- Security alerts: Dragos Platform alerts (all alert types) for OT and ICS threats, including the alert detail, severity, and affected assets. Normalized to third-party security alert telemetry.
Data provided by this integration
Data provided by the Dragos Platform gets normalized to the following schemas:
thirdpartyalert
For more information about using schemas in Data Lake Search, see Schemas and logical types.