Dragos Platform Integration
The Corsha mIDP integrates with the Dragos Platform to automatically import and synchronize industrial control system (ICS) and operational technology (OT) assets as machine identities. This integration enables organizations to leverage Dragos's purpose-built OT asset visibility while applying Corsha's zero-trust network segmentation and access controls.
Overview
The Dragos Platform provides comprehensive asset discovery, threat detection, and vulnerability management for industrial environments. Through direct integration, Corsha adds identity-based access management, microsegmentation, and policy-based enforcement to cyber-physical systems monitored by the Dragos Platform.
Key Benefits:
- Automated OT Asset Import: ICS/OT devices discovered by Dragos are automatically imported as machine identities
- Continuous Synchronization: Asset inventory remains current as Dragos discovers new devices or detects changes
- Industrial Protocol Awareness: Leverage Dragos's deep understanding of industrial protocols for policy creation
- Threat-Informed Segmentation: Apply zero-trust controls to assets flagged by Dragos threat intelligence
- Unified OT Security: Combine Dragos threat detection with Corsha access control for defense in depth
Asset Information Imported
The following information is imported from Dragos Platform:
- Device Identification: IP address, MAC address, hostname, serial number
- Device Classification: Asset type, vendor, model, firmware version
- Industrial Protocols: Supported ICS protocols (Modbus TCP, OPC UA, EtherNet/IP, DNP3, IEC 61850, etc.)
- Network Topology: Network zones, VLANs, logical segments
- Operational Context: Site location, system function, Purdue Model level
- Security Context: Vulnerability status, threat indicators, risk scoring
- Last Activity: Most recent communication timestamp
Viewing Dragos Assets in the Corsha Console
Once the integration is configured, Dragos-discovered assets automatically appear in the Corsha Console as a trusted identity source.
Identity Sources Dashboard
The Identity Sources page shows the Dragos integration status and provides an overview of discovered assets:
Asset Discovery Sources:
- Platform: Dragos Machines
- Assets Synced: Number of assets synchronized from Dragos
- Machine Identities Mapped: Number of identities successfully mapped
- Last Sync: Most recent synchronization timestamp
Machine Identities List View
Navigate to Machine Identities to view and manage all Dragos-mapped identities:
Features:
- Filter by Identity Source: Use the "Identity Source: Dragos" filter to view only Dragos-discovered machines
- Search: Find specific machines by name, IP address, or identifier
- Status Indicator: View real-time status (Running, Halted, etc.)
- Last Activity: Track when each machine was last active
- Created On: See when the identity was first discovered
All Dragos-mapped entries display their Identity Source as "Dragos" with the distinctive Dragos icon.
Individual Machine Identity Details
Click on any machine identity to view comprehensive details and Dragos-specific attributes:
Machine Activity Summary:
- Violations: Track any policy violations
- Secret Age: Monitor credential freshness
- Last Used: See most recent activity timestamp
- Status: Real-time machine status (Running/Halted)
Machine Details Section:
- Instance ID: Unique identifier from Dragos
- MFA Enabled: Shows if multi-factor authentication is configured
- Description: Asset description from Dragos
- Identity Source: Confirms Dragos as the source
- Machine Group: Organizational grouping
Dragos Device Attributes:
This section displays rich contextual data synchronized from the Dragos Platform:
| Attribute | Description |
|---|---|
| Asset ID | Dragos's unique asset identifier |
| Asset Name | Device name from Dragos |
| Asset Class | Device classification (e.g., Connectivity) |
| Asset Type | Device type (e.g., Switch, PLC, HMI) |
| Vendor | Equipment manufacturer |
| Observed By | Dragos sensor that discovered the asset |
| First Seen | Timestamp when asset was first discovered |
| Last Seen | Most recent activity detection |
Configuration
Contact your Corsha Technical Point of Contact (TPOC) for assistance configuring the Dragos Platform integration.
For best practices on using asset discovery integrations, see Asset Discovery Sources Best Practices.
Next Steps
- Asset Discovery Sources Overview for integration best practices
- Managing Machine Identities to work with imported assets
- Machine Groups to organize imported machines