Performs ICS/OT asset discovery with Claroty xDome, combining passive monitoring and Claroty Edge active queries to inventory PLCs, RTUs, HMIs, and network infrastructure across Purdue Model levels. Use when gaining visibility into an undocumented OT environment, preparing an IEC 62443 asset inventory, or onboarding Claroty xDome; not for IT-only discovery.
Instrucciones de origen · Vista previa de solo lectura
name
performing-ics-asset-discovery-with-claroty
description
Performs ICS/OT asset discovery with Claroty xDome, combining passive monitoring and Claroty Edge active queries to inventory PLCs, RTUs, HMIs, and network infrastructure across Purdue Model levels. Use when gaining visibility into an undocumented OT environment, preparing an IEC 62443 asset inventory, or onboarding Claroty xDome; not for IT-only discovery.
When gaining initial visibility into an OT environment with unknown or poorly documented assets
When preparing for an IEC 62443 risk assessment requiring a complete asset inventory
When onboarding Claroty xDome into a brownfield industrial environment
When validating existing asset inventory against actual network communications
When identifying shadow OT devices or unauthorized connections in the control network
Do not use for IT-only asset discovery (use tools like Nessus or Qualys), for active scanning of sensitive PLC networks without vendor approval, or for environments where Claroty is not the deployed platform (see implementing-ot-network-traffic-analysis-with-nozomi).
Prerequisites
Claroty xDome SaaS subscription or on-premises deployment
Network TAP or SPAN port configured at OT network boundaries (Levels 1-3 of Purdue Model)
Claroty Edge collector deployed for safe active querying of hard-to-reach network segments
Integration credentials for CMDB tools (ServiceNow, BMC) if used
Network architecture diagram showing VLANs, switches, and firewall zones
Workflow
Step 1: Configure Passive Network Monitoring
Deploy Claroty sensors on SPAN ports to passively observe all OT network traffic without impacting operations.
Step 2: Configure Active Discovery with Claroty Edge
Claroty Edge performs safe, targeted queries of OT devices using native industrial protocols (not IT scanning) to extract detailed asset information from devices that passive monitoring alone cannot fully identify.
# Claroty Edge Active Discovery Configuration# Safe active queries using native industrial protocolsedge_configuration:deployment_mode:"on-premises"collection_schedule:frequency:"weekly"maintenance_window:"Sunday 02:00-06:00"max_concurrent_queries:5protocol_queries:siemens_s7:enabled:truetarget_subnets: ["10.10.1.0/24", "10.10.2.0/24"]
ports: [102]
query_type:"SZL_read"information_collected:-"Module identification"-"Firmware version"-"Hardware configuration"-"Protection level"rockwell_cip:enabled:truetarget_subnets: ["10.10.3.0/24"]
ports: [44818]
query_type:"CIP_identity"information_collected:-"Product name and revision"-"Serial number"-"Device type"-"Vendor ID"modbus:enabled:truetarget_subnets: ["10.10.4.0/24"]
ports: [502]
query_type:"read_device_identification"function_code:43information_collected:-"Vendor name"-"Product code"-"Firmware revision"bacnet:enabled:truetarget_subnets: ["10.10.5.0/24"]
ports: [47808]
query_type:"who_is"information_collected:-"Device name"-"Vendor identifier"-"Model name"-"Application software version"safety_controls:excluded_subnets: ["10.10.100.0/24"] # SIS network - never active scanrate_limiting:truemax_packets_per_second:10timeout_seconds:5retry_count:1abort_on_device_error:true
Step 3: Validate and Enrich Asset Data
Cross-reference discovered assets against known inventories and enrich with vulnerability data.
#!/usr/bin/env python3"""Asset Validation and Enrichment Tool.
Cross-references Claroty discovery results against existing CMDB
and enriches with NVD vulnerability data.
"""import json
import csv
import sys
from datetime import datetime
try:
import requests
except ImportError:
print("Install requests: pip install requests")
sys.exit(1)
classAssetValidator:
"""Validates and enriches OT asset inventory."""def__init__(self, inventory_file: str):
self.discovered_assets = []
self.load_inventory(inventory_file)
self.discrepancies = []
defload_inventory(self, filepath: str):
"""Load Claroty-discovered asset inventory."""withopen(filepath, "r") as f:
reader = csv.DictReader(f)
self.discovered_assets = list(reader)
print(f"[*] Loaded {len(self.discovered_assets)} discovered assets")
defcompare_with_cmdb(self, cmdb_file: str):
"""Compare discovered assets against CMDB records."""withopen(cmdb_file, "r") as f:
cmdb_assets = {row["ip_address"]: row for row in csv.DictReader(f)}
discovered_ips = {a["ip_address"] for a inself.discovered_assets if a["ip_address"]}
cmdb_ips = set(cmdb_assets.keys())
shadow_devices = discovered_ips - cmdb_ips
missing_devices = cmdb_ips - discovered_ips
print(f"\n{'='*60}")
print("ASSET INVENTORY VALIDATION REPORT")
print(f"{'='*60}")
print(f"Discovered assets: {len(discovered_ips)}")
print(f"CMDB records: {len(cmdb_ips)}")
print(f"Shadow OT devices (not in CMDB): {len(shadow_devices)}")
print(f"Missing devices (in CMDB, not seen): {len(missing_devices)}")
if shadow_devices:
print(f"\n SHADOW DEVICES (Unauthorized/Undocumented):")
for ip insorted(shadow_devices):
asset = next((a for a inself.discovered_assets if a["ip_address"] == ip), {})
print(f" - {ip} | {asset.get('vendor', 'Unknown')}{asset.get('model', '')} | Type: {asset.get('type', 'Unknown')}")
self.discrepancies.append({
"type": "SHADOW_DEVICE",
"severity": "HIGH",
"ip": ip,
"detail": f"Undocumented {asset.get('type', 'device')} from {asset.get('vendor', 'unknown vendor')}",
})
if missing_devices:
print(f"\n MISSING DEVICES (Expected but not seen):")
for ip insorted(missing_devices):
cmdb = cmdb_assets[ip]
print(f" - {ip} | {cmdb.get('name', 'Unknown')} | Last CMDB update: {cmdb.get('last_updated', 'N/A')}")
self.discrepancies.append({
"type": "MISSING_DEVICE",
"severity": "MEDIUM",
"ip": ip,
"detail": f"CMDB asset {cmdb.get('name', ip)} not seen on network",
})
defcheck_firmware_vulnerabilities(self, asset):
"""Check NVD for known vulnerabilities matching asset firmware."""
vendor = asset.get("vendor", "").lower()
model = asset.get("model", "").lower()
firmware = asset.get("firmware_version", "")
ifnot vendor ornot model:
return []
search_term = f"{vendor}{model}"try:
resp = requests.get(
"https://services.nvd.nist.gov/rest/json/cves/2.0",
params={"keywordSearch": search_term, "resultsPerPage": 10},
timeout=15,
)
if resp.status_code == 200:
data = resp.json()
return data.get("vulnerabilities", [])
except requests.RequestException:
passreturn []
defgenerate_risk_summary(self):
"""Generate risk-prioritized summary of findings."""print(f"\n{'='*60}")
print("RISK SUMMARY")
print(f"{'='*60}")
high_risk = [a for a inself.discovered_assets iffloat(a.get("risk_score", 0)) >= 7]
end_of_life = [a for a inself.discovered_assets if a.get("firmware_version", "").startswith("v1.")]
no_encryption = [a for a inself.discovered_assets if"modbus"in a.get("protocol", "").lower()]
print(f" High-risk assets (score >= 7): {len(high_risk)}")
print(f" Potentially end-of-life firmware: {len(end_of_life)}")
print(f" Assets using unencrypted protocols: {len(no_encryption)}")
print(f" Inventory discrepancies: {len(self.discrepancies)}")
if __name__ == "__main__":
iflen(sys.argv) < 2:
print("Usage: python validate_assets.py <claroty_export.csv> [cmdb_export.csv]")
sys.exit(1)
validator = AssetValidator(sys.argv[1])
iflen(sys.argv) >= 3:
validator.compare_with_cmdb(sys.argv[2])
validator.generate_risk_summary()
Key Concepts
Term
Definition
Passive Monitoring
Observing mirrored network traffic via SPAN/TAP without injecting packets, safe for all OT devices
Claroty's safe active discovery collector that uses native industrial protocols rather than IT scanning
Purdue Level
Hierarchical classification of industrial network assets from Level 0 (physical process) to Level 5 (enterprise)
Shadow OT Device
Asset connected to the OT network that is not documented in the asset management system
xDome
Claroty's SaaS-based cyber-physical systems protection platform providing visibility, risk management, and threat detection
Common Scenarios
Scenario: Brownfield Factory Asset Discovery
Context: A manufacturing plant with 20 years of equipment additions needs a complete OT asset inventory for an IEC 62443 risk assessment. No accurate asset records exist.
Approach:
Deploy Claroty sensors on SPAN ports at each major network segment (control, supervisory, DMZ)
Allow passive monitoring for 2-4 weeks to capture all regular communication patterns
Schedule Claroty Edge active queries during a planned maintenance window
Export discovered inventory and categorize assets by Purdue level, vendor, and criticality
Cross-reference against any existing documentation (P&ID diagrams, network drawings)
Identify shadow devices and initiate a review process with plant operations
Feed validated inventory into IEC 62443 zone and conduit risk assessment
Pitfalls: Do not rush active discovery before passive monitoring has captured baseline traffic patterns. Never use IT vulnerability scanners (Nessus active scans) directly against PLCs or RTUs -- this can crash legacy controllers. Always exclude Safety Instrumented Systems (SIS) from active queries.
