| Controller, logic & configuration change monitoring | Partially Supported | What configuration, module, licensing, integration or operating assumption is required for this capability in the target operating model? | Dragos monitors OT communications and abnormal operational behavior, but a universal code-diff/configuration-control function for every controller family is not inferred from the reviewed sources. |
| Industrial network topology & communication mapping | Supported | What configuration, module, licensing, integration or operating assumption is required for this capability in the target operating model? | Dragos maps OT assets, protocols and communications and supports network/zone maps for architecture and segmentation analysis. |
| OT vulnerability & exposure prioritization | Supported | What configuration, module, licensing, integration or operating assumption is required for this capability in the target operating model? | Dragos maps vulnerabilities to real assets and prioritizes them with OT-corrected scoring and the Now, Next, Never remediation framework. |
| Passive OT/ICS asset discovery & fingerprinting | Supported | What configuration, module, licensing, integration or operating assumption is required for this capability in the target operating model? | Dragos uses passive-first industrial discovery and continuously maintains OT/xOT asset inventory without operational disruption. |
| Safe active querying & asset enrichment | Supported | What configuration, module, licensing, integration or operating assumption is required for this capability in the target operating model? | Dragos Active Collector adds targeted active collection for firmware, OS, patch and device details while preserving passive-first discovery. |
| Behavioral anomaly & OT threat detection | Supported | What configuration, module, licensing, integration or operating assumption is required for this capability in the target operating model? | Dragos continuously inspects industrial communications and behavior using OT-native detections, adversary intelligence and known/unknown behavior context. |
| Multi-site, hybrid & air-gapped OT operations | Supported | What configuration, module, licensing, integration or operating assumption is required for this capability in the target operating model? | Current Dragos deployment options explicitly include managed SaaS on Azure, on-premises and hybrid models for distributed industrial environments. |
| OT threat intelligence & ATT&CK context | Supported | What configuration, module, licensing, integration or operating assumption is required for this capability in the target operating model? | The Dragos Intelligence Fabric and OT threat detections provide adversary research, IOCs/TTPs and MITRE ATT&CK for ICS context directly in analyst workflows. |
| Segmentation, zones & policy-violation monitoring | Supported | What configuration, module, licensing, integration or operating assumption is required for this capability in the target operating model? | Dragos explicitly provides segmentation validation, zone/connection maps and firewall checks to verify industrial network architecture and policy. |
| SIEM, SOAR, firewall & SOC integration | Supported | What configuration, module, licensing, integration or operating assumption is required for this capability in the target operating model? | Dragos integrates OT asset, alert, vulnerability and threat-intelligence data with SIEM/SOAR platforms including Microsoft Sentinel and Splunk. |
