Exposure Management: Difference between revisions

From CyberWiki
Jump to navigation Jump to search
(Created page with "= Threat Detection & Monitoring = == Dragos == === Key Findings === * Comprehensive OT asset discovery and inventory. * Behavioral and anomaly-based threat detection. * OT asset visibility for PLCs, HMIs, DCS, and SCADA systems. * Supports vulnerability management and incident response. === Strengths === * OT-aware analytics. * SIEM integration through Splunk. * Reduced false positives through OT-focused detections. == Trellix == === Key Findings === * Dis...")
 
m (EPhann2 moved page Threat Monitoring to Exposure Management)
 
(3 intermediate revisions by the same user not shown)
Line 1: Line 1:
= Threat Detection & Monitoring =
== Dragos ==
== Dragos ==


Line 33: Line 31:


* Some features require supporting subscriptions and integrations.  
* Some features require supporting subscriptions and integrations.  
* Legacy OT environments may limit endpoint visibility.  
* Legacy OT environments may limit endpoint visibility.
 
= OT Asset Visibility =
 
== Executive Summary ==
 
OT visibility platforms provide foundational capabilities for inventory management, behavioral baselining, protocol awareness, and security operations integration.
 
== Core Findings ==
 
=== Asset Discovery ===
 
* Inventories PLCs, HMIs, DCS, SCADA, operating systems, and industrial protocols.
* Uses passive monitoring to avoid operational disruption.
 
=== Asset Context ===
 
* Correlates protocol, behavioral, and communications data.
* Enables better risk prioritization and asset classification.
 
=== Integration ===
 
* Integrates with SIEM platforms such as Splunk.
* Shares asset visibility data across security platforms.
 
== Recommended Practices ==
 
* Deploy passive sensors first.
* Establish complete OT asset inventories.
* Integrate OT telemetry into enterprise SIEM platforms.
*

Latest revision as of 17:03, 21 October 2026

Dragos

Key Findings

  • Comprehensive OT asset discovery and inventory.
  • Behavioral and anomaly-based threat detection.
  • OT asset visibility for PLCs, HMIs, DCS, and SCADA systems.
  • Supports vulnerability management and incident response.

Strengths

  • OT-aware analytics.
  • SIEM integration through Splunk.
  • Reduced false positives through OT-focused detections.

Trellix

Key Findings

  • Discovers unmanaged OT assets automatically.
  • Integrates operational threat intelligence and investigation workflows.
  • Centralized management through ePO.

Strengths

  • Extensive threat intelligence visibility.
  • Automated asset discovery.
  • Supports threat hunting and investigations.

Limitations

  • Some features require supporting subscriptions and integrations.
  • Legacy OT environments may limit endpoint visibility.
Retrieved from "https://cyberwiki.epri.com/index.php?title=Exposure_Management&oldid=561"