Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ title: Dragos Source
sidebar_label: Dragos
tags:
- Dragos
description: Collect address, asset, vulnerability, and zone details from the Dragos API and send them to Sumo Logic.
description: Collect address, asset, vulnerability, notification, and zone details from the Dragos API and send them to Sumo Logic.
---
import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/dragos/example.json';
Expand All @@ -17,13 +17,14 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
Dragos is a cybersecurity platform with an ecosystem tailored for industrial environments, including Industrial Control Systems (ICS), Supervisory Control and Data Acquisition (SCADA), Distributed Control System (DCS), and Operational Technology (OT) environments.
Dragos's Operational Technology (OT) offers clear visibility into your Industrial Control System (ICS) assets and communications. It monitors networks, detects threats, and addresses vulnerabilities without causing disruptions or shutdowns, helping you respond confidently to potential threats.

The Dragos source collects address, asset, vulnerability, and zone details from the Dragos API and sends it to Sumo Logic for streamlined analysis.
The Dragos source collects address, asset, vulnerability, notification, and zone details from the Dragos API and sends it to Sumo Logic for streamlined analysis.

## Data collected

| Polling Interval | Data |
| :--- | :--- |
| 5 minutes | Vulnerability |
| 5 minutes | Vulnerabilities |
| 5 minutes | Notifications |
| 24 hours | Addresses |
| 24 hours | Zones |
| 24 hours | Assets |
Expand Down Expand Up @@ -89,15 +90,16 @@ Sources can be configured using UTF-8 encoded JSON files with the Collector Ma
| requestEndpoint | String | Yes | `null` | The API URL to fetch the data from the Dragos log source. | `https://sumologic-dragos.cxc.dragos.cloud/` |
| apiID | String | Yes | `null` | API ID of your account for authorization. | `036fxxxx-b642-xxxx-99d3-fcxxxx2exxxx` |
| apiSecret | String | Yes | `null` | API Secret of your account for authorization. | `xxxU1TxxxxxxxxKSJwHYOpK37xxxxxxxxrEHAkU91xxxxxxxxxFrrJ06xxx` |
| pollingIntervalVulnerabilityMin | String | Yes | `5 minutes` | Time interval (in minutes) after which the source will check for new data for API.<br/>**Default**: 5 minutess <br/>**Minimum**: 5 minutes<br/>**Maximum**: 60 minutes | |
| pollingIntervalVulnerabilityMin | String | Yes | `5 minutes` | Time interval (in minutes) after which the source will check for new data for API.<br/>**Default**: 5 minutes <br/>**Minimum**: 5 minutes<br/>**Maximum**: 60 minutes | |
| pollingIntervalAddressesHour | String | Yes | `24 hours` | Time interval (in hours) after which the source will check for new data for API.<br/>**Default**: 24 hours<br/>**Minimum**: 12 hours<br/>**Maximum**: 24 hours | |
| pollingIntervalZonesHour | String | Yes | `24 hours` | Time interval (in hours) after which the source will check for new data for API.<br/>**Default**: 24 hours<br/>**Minimum**: 12 hours<br/>**Maximum**: 24 hours | |
| pollingIntervalAssetsHour | String | Yes | `24 hours` | Time interval (in hours) after which the source will check for new data for API.<br/>**Default**: 24 hours<br/>**Minimum**: 12 hours<br/>**Maximum**: 24 hours | |
| collectAddressDetails | Boolean | No | `True` | Specify if you need to collect the address details. | |
| collectZoneDetails | Boolean | No | `True` | Specify if you need to collect the zone details. | |
| collectDeviceDetails | Boolean | No | `True` | Specify if you need to collect the assets details. | |
| collectVulnerabilityDetails | Boolean | No | `True` | Specify if you need to collect the vulnerability details. | |

| pollingIntervalNotificationMin | String | Yes | `5 minutes` | Time interval (in minutes) after which the source will check for new data for API.<br/>**Default**: 5 minutes <br/>**Minimum**: 5 minutes<br/>**Maximum**: 60 minutes | |
| collectAddressDetails | Boolean | No | `False` | Specify if you need to collect the address details. | |
| collectZoneDetails | Boolean | No | `False` | Specify if you need to collect the zone details. | |
| collectDeviceDetails | Boolean | No | `False` | Specify if you need to collect the assets details. | |
| collectVulnerabilityDetails | Boolean | No | `False` | Specify if you need to collect the vulnerability details. | |
| collectNotificationDetails | Boolean | No | `False` | Specify if you need to collect the notification details. | |
### JSON example

<CodeBlock language="json">{MyComponentSource}</CodeBlock>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -252,7 +252,7 @@ In this section, we'll introduce the following concepts:
<div className="box smallbox card">
<div className="container">
<a href="/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/dragos-source"><img src={useBaseUrl('img/send-data/dragos-logo.png')} alt="Thumbnail icon" width="50"/><h4>Dragos</h4></a>
<p>Learn how to collect address, asset, vulnerability, and zone details from the Dragos API and send them to Sumo Logic.</p>
<p>Learn how to collect address, asset, vulnerability, notification, and zone details from the Dragos API and send them to Sumo Logic.</p>
</div>
</div>
<div className="box smallbox card">
Expand Down
3 changes: 2 additions & 1 deletion static/files/c2c/dragos/example.json
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,10 @@
"apiSecret": "xxxU1TxxxxxxxxKSJwHYOpK37xxxxxxxxrEHAkU91xxxxxxxxxFrrJ06xxx",
"collectVulnerability": true,
"collectAddress": true,
"collectNotification": false,
"collectZone": false,
"collectAsset": false,
"pollingIntervalVulnerabilityMin": "24h",
"pollingIntervalVulnerabilityMin": "60m",
"pollingIntervalAddressesHour": "5h"
},
"schemaRef": {
Expand Down
3 changes: 2 additions & 1 deletion static/files/c2c/dragos/example.tf
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,10 @@ resource "sumologic_cloud_to_cloud_source" "dragos-source" {
"apiSecret": "xxxU1TxxxxxxxxKSJwHYOpK37xxxxxxxxrEHAkU91xxxxxxxxxFrrJ06xxx",
"collectVulnerability": true,
"collectAddress": true,
"collectNotification": false,
"collectZone": false,
"collectAsset": false,
"pollingIntervalVulnerabilityMin": "24h",
"pollingIntervalVulnerabilityMin": "60m",
"pollingIntervalAddressesHour": "5h"
})
}
Expand Down
Loading