Exposure Management - Revision history

EPhann2: EPhann2 moved page Threat Monitoring to Exposure Management

2026-10-21T17:03:58Z

EPhann2 moved page Threat Monitoring to Exposure Management

← Older revision	Revision as of 17:03, 21 October 2026
(No difference)

EPhann2 at 16:51, 21 October 2026

2026-10-21T16:51:46Z

← Older revision		Revision as of 16:51, 21 October 2026
Line 1:		Line 1:
	~~= Threat Detection & Monitoring =~~

	== Dragos ==		== Dragos ==

EPhann2 at 16:40, 21 October 2026

2026-10-21T16:40:13Z

← Older revision		Revision as of 16:40, 21 October 2026
Line 33:		Line 33:

	* Some features require supporting subscriptions and integrations.		* Some features require supporting subscriptions and integrations.
	* Legacy OT environments may limit endpoint visibility.		* Legacy OT environments may limit endpoint visibility.

	~~= OT Asset Visibility =~~

	~~== Executive Summary ==~~

	~~OT visibility platforms provide foundational capabilities for inventory management, behavioral baselining, protocol awareness, and security operations integration.~~

	~~== Core Findings ==~~

	~~=== Asset Discovery ===~~

	* Inventories PLCs, HMIs, DCS, SCADA, operating systems, and industrial protocols.
	* Uses passive monitoring to avoid operational disruption.

	~~=== Asset Context ===~~

	* Correlates protocol, behavioral, and communications data.
	* Enables better risk prioritization and asset classification.

	~~=== Integration ===~~

	* Integrates with SIEM platforms such as Splunk.
	* Shares asset visibility data across security platforms.

	~~== Recommended Practices ==~~

	* Deploy passive sensors first.
	* Establish complete OT asset inventories.
	* Integrate OT telemetry into enterprise SIEM platforms.
	* Leverage OT-focused threat intelligence feeds.

EPhann2: /* Recommended Practices */

2026-10-21T16:39:46Z

Recommended Practices

← Older revision		Revision as of 16:39, 21 October 2026
Line 63:		Line 63:
	* Establish complete OT asset inventories.		* Establish complete OT asset inventories.
	* Integrate OT telemetry into enterprise SIEM platforms.		* Integrate OT telemetry into enterprise SIEM platforms.
	*		* Leverage OT-focused threat intelligence feeds.

EPhann2: Created page with "= Threat Detection & Monitoring = == Dragos == === Key Findings === * Comprehensive OT asset discovery and inventory. * Behavioral and anomaly-based threat detection. * OT asset visibility for PLCs, HMIs, DCS, and SCADA systems. * Supports vulnerability management and incident response. === Strengths === * OT-aware analytics. * SIEM integration through Splunk. * Reduced false positives through OT-focused detections. == Trellix == === Key Findings === * Dis..."

2026-10-21T16:39:31Z

Created page with "= Threat Detection & Monitoring = == Dragos == === Key Findings === * Comprehensive OT asset discovery and inventory. * Behavioral and anomaly-based threat detection. * OT asset visibility for PLCs, HMIs, DCS, and SCADA systems. * Supports vulnerability management and incident response. === Strengths === * OT-aware analytics. * SIEM integration through Splunk. * Reduced false positives through OT-focused detections. == Trellix == === Key Findings === * Dis..."

New page

= Threat Detection & Monitoring =

== Dragos ==

=== Key Findings ===

* Comprehensive OT asset discovery and inventory.
* Behavioral and anomaly-based threat detection.
* OT asset visibility for PLCs, HMIs, DCS, and SCADA systems.
* Supports vulnerability management and incident response.

=== Strengths ===

* OT-aware analytics.
* SIEM integration through Splunk.
* Reduced false positives through OT-focused detections.

== Trellix ==

=== Key Findings ===

* Discovers unmanaged OT assets automatically.
* Integrates operational threat intelligence and investigation workflows.
* Centralized management through ePO.

=== Strengths ===

* Extensive threat intelligence visibility.
* Automated asset discovery.
* Supports threat hunting and investigations.

=== Limitations ===

* Some features require supporting subscriptions and integrations.
* Legacy OT environments may limit endpoint visibility.

= OT Asset Visibility =

== Executive Summary ==

OT visibility platforms provide foundational capabilities for inventory management, behavioral baselining, protocol awareness, and security operations integration.

== Core Findings ==

=== Asset Discovery ===

* Inventories PLCs, HMIs, DCS, SCADA, operating systems, and industrial protocols.
* Uses passive monitoring to avoid operational disruption.

=== Asset Context ===

* Correlates protocol, behavioral, and communications data.
* Enables better risk prioritization and asset classification.

=== Integration ===

* Integrates with SIEM platforms such as Splunk.
* Shares asset visibility data across security platforms.

== Recommended Practices ==

* Deploy passive sensors first.
* Establish complete OT asset inventories.
* Integrate OT telemetry into enterprise SIEM platforms.
*