Perform comprehensive ICS/OT asset discovery using Claroty xDome platform, leveraging passive monitoring, Claroty Edge active queries, and integration ecosystem to gain full visibility into industrial control system assets including PLCs, RTUs, HMIs, and network infrastructure across Purdue Model levels.
Perform comprehensive ICS/OT asset discovery using Claroty xDome platform, leveraging passive monitoring, Claroty Edge active queries, and integration ecosystem to gain full visibility into industrial control system assets including PLCs, RTUs, HMIs, and network infrastructure across Purdue Model levels.
When gaining initial visibility into an OT environment with unknown or poorly documented assets
When preparing for an IEC 62443 risk assessment requiring a complete asset inventory
When onboarding Claroty xDome into a brownfield industrial environment
When validating existing asset inventory against actual network communications
When identifying shadow OT devices or unauthorized connections in the control network
Do not use for IT-only asset discovery (use tools like Nessus or Qualys), for active scanning of sensitive PLC networks without vendor approval, or for environments where Claroty is not the deployed platform (see implementing-ot-network-traffic-analysis-with-nozomi).
Most Often Missed & How to Confirm
Discovery gaps come from over-trusting passive-only data or rushing active queries. Use the passive-vs-active tradeoff deliberately:
Passive misses quiet assets: a standby PLC, a serial device behind a gateway, or an IED that only talks during a trip never appears on the SPAN. Don't conclude an inventory is complete from passive alone — confirm against P&ID drawings and switch MAC/CAM tables.
Active discovery crashes legacy controllers: never point Nessus/nmap at Level 0-1. Use Claroty Edge native queries only (S7 SZL read on TCP 102, CIP Identity on 44818, Modbus FC43 on 502, BACnet Who-Is on 47808), rate-limited (~10 pps) and scheduled in a maintenance window.
SIS must be excluded: confirm Safety Instrumented System subnets are in the Edge excluded_subnets list before any active run — a Triconex that faults on an unexpected query is a safety event, not a finding.
Shadow and dual-homed hosts: an engineering laptop bridging IT and OT can show as two assets. Confirm by correlating MAC/serial across the comms map, not IP alone.
Positive signal that discovery worked: the asset returns vendor/model/firmware via its native protocol AND appears in the communication map talking to expected peers. A passive-only "seen" with no firmware is incomplete.
Don't conclude "no shadow OT" until passive has run a full cycle (2-4 weeks), active queries completed safely in-window, and the result is diffed against the CMDB.
Prerequisites
Claroty xDome SaaS subscription or on-premises deployment
Network TAP or SPAN port configured at OT network boundaries (Levels 1-3 of Purdue Model)
Claroty Edge collector deployed for safe active querying of hard-to-reach network segments
Integration credentials for CMDB tools (ServiceNow, BMC) if used
Network architecture diagram showing VLANs, switches, and firewall zones
Workflow
Step 1: Configure Passive Network Monitoring
Deploy Claroty sensors on SPAN ports to passively observe all OT network traffic without impacting operations.
Step 2: Configure Active Discovery with Claroty Edge
Claroty Edge performs safe, targeted queries of OT devices using native industrial protocols (not IT scanning) to extract detailed asset information from devices that passive monitoring alone cannot fully identify.
# Claroty Edge Active Discovery Configuration# Safe active queries using native industrial protocolsedge_configuration:deployment_mode:"on-premises"collection_schedule:frequency:"weekly"maintenance_window:"Sunday 02:00-06:00"max_concurrent_queries:5protocol_queries:siemens_s7:enabled:truetarget_subnets: ["10.10.1.0/24", "10.10.2.0/24"]
ports: [102]
query_type:"SZL_read"information_collected:-"Module identification"-"Firmware version"-"Hardware configuration"-"Protection level"rockwell_cip:enabled:truetarget_subnets: ["10.10.3.0/24"]
ports: [44818]
query_type:"CIP_identity"information_collected:-"Product name and revision"-"Serial number"-"Device type"-"Vendor ID"
[]
[]
[]
[]
[]
Step 3: Validate and Enrich Asset Data
Cross-reference discovered assets against known inventories and enrich with vulnerability data.
Claroty's safe active discovery collector that uses native industrial protocols rather than IT scanning
Purdue Level
Hierarchical classification of industrial network assets from Level 0 (physical process) to Level 5 (enterprise)
Shadow OT Device
Asset connected to the OT network that is not documented in the asset management system
xDome
Claroty's SaaS-based cyber-physical systems protection platform providing visibility, risk management, and threat detection
Common Scenarios
Scenario: Brownfield Factory Asset Discovery
Context: A manufacturing plant with 20 years of equipment additions needs a complete OT asset inventory for an IEC 62443 risk assessment. No accurate asset records exist.
Approach:
Deploy Claroty sensors on SPAN ports at each major network segment (control, supervisory, DMZ)
Allow passive monitoring for 2-4 weeks to capture all regular communication patterns
Schedule Claroty Edge active queries during a planned maintenance window
Export discovered inventory and categorize assets by Purdue level, vendor, and criticality
Cross-reference against any existing documentation (P&ID diagrams, network drawings)
Identify shadow devices and initiate a review process with plant operations
Feed validated inventory into IEC 62443 zone and conduit risk assessment
Pitfalls: Do not rush active discovery before passive monitoring has captured baseline traffic patterns. Never use IT vulnerability scanners (Nessus active scans) directly against PLCs or RTUs -- this can crash legacy controllers. Always exclude Safety Instrumented Systems (SIS) from active queries.
