}){kind=logo}
The Sumo Logic app for Dragos provides deep visibility into industrial cybersecurity by analyzing critical data across addresses, assets, vulnerabilities, zones, and notifications within your Dragos-managed environment. This app enables IT and OT security teams to gain real-time insights into your asset behaviors, network segmentation, threat intelligence, and risk exposure, allowing for proactive threat detection and response.
By leveraging the Dragos security insights, you can monitor industrial control systems (ICS) and operational technology (OT) environments with enhanced situational awareness. The app’s pre-configured dashboards offer detailed visibility into asset inventory, security vulnerabilities, zone-based access controls, and system notifications. Analysts can track emerging threats, unauthorized access attempts, configuration changes, and high-risk vulnerabilities to fortify security posture and ensure compliance with industry standards.
With real-time alerting and actionable intelligence, this Sumo Logic app for Dragos helps you to minimize cybersecurity risks, improve operational resilience, and safeguard critical infrastructure from evolving cyber threats.
:::info
This app includes [built-in monitors](#dragos-alerts). For details on creating custom monitors, refer to [Create monitors for Dragos app](#create-monitors-for-dragos-app).
:::
## Log types
This app uses Sumo Logic's [Dragos Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/dragos-source/#data-collected) to collect Vulnerabilities, Notifications, Addresses, Zones, and Assets logs from the Dragos platform.
### Sample log messages
Rockwell Automation GuardLogix and ControlLogix are Programmable Logic Controllers (PLCs). They are deployed worldwide and seen across a variety of industries.
", "title": "Rockwell Automation GuardLogix and ControlLogix controllers", "type": "Improper Input Validation", "playbooks": [ "Implement CIP security where practical. Ensure control systems are segmented from Enterprise and internet.
" ], "severity": "High", "mitigations": [ "Update to a patched version:
Successful exploitation could allow an unauthenticated and remote adversary to cause a Major Non-Recoverable Fault (MNRF) and a Denial of Service (DoS) through a crafted CIP request.
", "resources": [ { "title": "ICSA-22-354-02", "url": "https://us-cert.cisa.gov/ics/advisories/ICSA-22-354-02" }, { "title": "PN1613", "url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137757" }, { "title": "CIP security", "url": "https://literature.rockwellautomation.com/idc/groups/literature/documents/at/secure-at001_-en-p.pdf" } ], "intel": { "active_exploit": false, "poc_exists": false, "remotely_exploitable": true, "physical_access": false, "known_credentials": false, "user_interaction": false, "dos": true, "credential_exposure": false, "code_execution": false, "broader_network_access": false, "privilege_escalation": false, "data_theft": false, "skill_level": "Low" }, "modified_date": "2022-12-29T17:07:50.000Z" }, "event": { "dataset": "worldview.vulnerability.api", "timezone": "GMT", "confidence": 3, "disposition": "Not Set", "start": "2024-11-12T23:49:58.692Z", "id": "9c6dac6c-aff5-5ec9-7e97-66e45b5a5fc0", "risk_score": 0.6, "priority": "Next", "created": "2025-02-03T23:45:07.031Z", "end": "2025-02-03T23:45:07.031Z", "duration": 7170908338999 }, "labels": { "System Owner": "John Smith", "Criticality": "", "Country": "USA", "AttributesLastObservedDate": "2025-02-03", "cip_name": [ "1756-L71/B LOGIX5571" ], "zone_name": "Pump system", "Monitored": "true", "ObservedBy": [ "pumping-station-01" ], "x": "-19209.74", "CrowdStrike ID": "", "Zone": "Pump system", "y": "-8093.57", "CrowdStrike Last Seen": "", "es_doc_id": "106-dragos-advisory-2932" } } ```
### Assets and Addresses
The **Dragos - Assets and Addresses** dashboard offers detailed insights into assets and network addresses across your industrial environment. It highlights total assets, OT hosts, and distribution by host type and class, providing a clear view of infrastructure composition. The key metrics of this dashboard include the top 10 host vendors and recently detected assets, enabling teams to track device activity. The dashboard also examines total addresses, classifications, and geolocation data, including restricted regions, to enhance security and compliance. With real-time monitoring, it helps organizations maintain asset oversight and network reliability.
### Zones and Notifications
The **Dragos - Zones and Notifications** dashboard provides insights into network segmentation and security alerts within your industrial environment. It tracks total zones, external communications, and asset distribution, offering a clear view of network structure and potential risks. For threat monitoring, the dashboard displays total notifications, their status (retained, reviewed, and unresolved), and classification by type and severity. It also highlights notifications over time, recent alerts, and threat summaries, enabling proactive security response. This dashboard helps teams enhance visibility, strengthen defenses, and ensure a secure operational environment.
## Create monitors for Dragos app
import CreateMonitors from '../../reuse/apps/create-monitors.md';