Deploy and configure the Dragos Platform for OT network monitoring, leveraging its 600+ industrial protocol parsers, intelligence-driven threat detection analytics, and asset visibility capabilities to protect ICS environments against threat groups like VOLTZITE, GRAPHITE, and BAUXITE.
Deploy and configure the Dragos Platform for OT network monitoring, leveraging its 600+ industrial protocol parsers, intelligence-driven threat detection analytics, and asset visibility capabilities to protect ICS environments against threat groups like VOLTZITE, GRAPHITE, and BAUXITE.
When deploying an OT-specific network detection and response (NDR) solution for industrial environments
When needing threat intelligence-driven detection against known ICS threat groups (VOLTZITE, CHERNOVITE, KAMACITE)
When building an OT SOC capability with purpose-built industrial security tooling
When requiring asset discovery and vulnerability management alongside threat detection in a single platform
When integrating OT security monitoring with an enterprise SIEM (Splunk, Sentinel, QRadar)
Do not use for IT-only network monitoring without ICS components, for endpoint detection and response (EDR) on OT workstations, or for environments standardized on Claroty or Nozomi (see respective skills).
Common Misconfigurations & Verification
SPAN/TAP coverage gaps leave zones dark. A sensor only sees what the mirror port forwards; truncated SPAN, oversubscribed mirrors that drop packets under load, and serial/fieldbus segments below the switch produce silent blind spots. Verify per-segment coverage against the asset inventory, not just a green sensor status.
Passive-only means no visibility into quiet assets. Devices that rarely talk may never be discovered passively; use collection/active queries carefully and only with native protocols, never active port scans against fragile PLCs.
Stale Knowledge Packs miss current threat groups. Detection for VOLTZITE/CHERNOVITE and newer groups depends on current Knowledge Packs; confirm auto-update is working and the sensor reports a recent version.
Baseline learning period set too short. Cutting the ~30-day learning window yields a baseline that alarms on normal batch and shift variation; verify the window spanned representative operating modes.
Verify without disruption. Confirm sensor health via packets/sec and asset counts, replay a known IOC sample into a test sensor, and validate SIEM forwarding with a synthetic notification — all passively, never by generating attack traffic on the live OT network.
Prerequisites
Dragos Platform license and deployment package
Network TAP or SPAN port at OT network boundaries (one sensor per monitored segment)
Step 2: Configure Detection Analytics and Knowledge Packs
# Dragos Platform Detection Configuration# Tuned for manufacturing/energy environmentdetection_configuration:knowledge_pack:auto_update:trueupdate_schedule:"weekly"include_threat_groups:-"VOLTZITE"# Targets energy sector, exfiltrates OT diagrams-"GRAPHITE"# New 2025 threat group targeting ICS-"BAUXITE"# New 2025 threat group targeting ICS-"CHERNOVITE"# Developed PIPEDREAM/INCONTROLLER framework-"ELECTRUM"# Linked to Industroyer/CrashOverride-"KAMACITE"# Targets energy sector initial accessdetection_categories:network_baseline:enabled:truelearning_period_days:30alert_on:-"new_communication_pair"-"new_protocol_detected"-"new_device_on_network"-"protocol_anomaly"threat_detection:enabled:truealert_on:-"known_malware_ioc"-"threat_group_ttp"-"lateral_movement"-"command_and_control"-"data_exfiltration"vulnerability_correlation:enabled:truealert_on:-"active_exploitation_attempt"-"vulnerability_with_public_exploit"protocol_monitoring:modbus:monitor_writes:truebaseline_function_codes:truebaseline_register_ranges:truednp3:monitor_control_commands:truedetect_firmware_updates:trues7comm:detect_cpu_stop:truedetect_program_download:trueopc_ua:monitor_method_calls:truedetect_browsing:trueethernet_ip:monitor_cip_services:truedetect_firmware_flash:truealert_routing:critical:notify: ["ot_soc_team", "plant_manager"]
siem_forward:trueauto_ticket:truehigh:notify: ["ot_soc_team"]
siem_forward:trueauto_ticket:truemedium:siem_forward:truelow:siem_forward:true
Key Concepts
Term
Definition
Dragos Platform
Purpose-built OT cybersecurity platform with asset visibility, threat detection, and vulnerability management for ICS environments
Knowledge Pack
Dragos threat intelligence update containing detection analytics for new threats, malware, and vulnerability exploits specific to ICS
SiteStore
Dragos central management server aggregating data from all deployed sensors across a site
VOLTZITE
Dragos-tracked threat group targeting energy sector OT environments, exfiltrating GIS data and ICS network diagrams
PIPEDREAM/INCONTROLLER
Modular ICS attack framework developed by CHERNOVITE, targeting Schneider/OMRON PLCs and OPC UA servers
Neighborhood Keeper
Dragos community defense program sharing anonymized threat data across participating OT environments
Common Scenarios
Scenario: Detecting VOLTZITE Reconnaissance in Energy Utility
Context: A Dragos sensor deployed at an electric utility detects unusual OPC UA browsing activity and exfiltration of device configuration data from an engineering workstation.
Approach:
Review the Dragos notification for MITRE ATT&CK ICS technique mapping
Identify the source host performing OPC UA browsing (check if it is an authorized engineering workstation)
Check Dragos threat intelligence correlation for VOLTZITE TTPs
Examine the scope of data accessed (GIS data, network diagrams, ICS configuration files)
Isolate the compromised workstation from the OT network
Check for lateral movement indicators to other OT systems
Engage Dragos Professional Services if threat group attribution is confirmed
Report to CISA as a critical infrastructure cyber incident
Pitfalls: Do not ignore OPC UA browsing alerts as false positives -- VOLTZITE specifically uses this technique for pre-positioning. Ensure Dragos Knowledge Packs are current to detect the latest VOLTZITE indicators. Do not reimage the compromised workstation before collecting forensic evidence.
Output Format
DRAGOS OT MONITORING DEPLOYMENT REPORT
==========================================
Site: [Site Name]
Date: YYYY-MM-DD
SENSOR DEPLOYMENT:
Total Sensors: [count]
Operational: [count]
Coverage: [percentage of OT segments monitored]
ASSET VISIBILITY:
Total OT Assets: [count]
PLCs: [count] | HMIs: [count] | Network Devices: [count]
Protocols: [list]
THREAT DETECTION:
Active Threat Groups Relevant: [count]
Detection Analytics Loaded: [count]
Alerts (Last 30 Days): [count by severity]
SIEM INTEGRATION:
Status: [Connected/Disconnected]
Events Forwarded (Last 24h): [count]
