Claroty xDome Integration Guide🔗
Claroty xDome is a cloud-managed OT/IoT security platform that provides continuous asset discovery, risk assessment, network protection, and threat detection for industrial control system (ICS), operational technology (OT), and connected device environments. It aggregates telemetry from distributed collection servers deployed on your network into a centralized SaaS management console.
The following instructions are for configuring xDome to forward security events to Secureworks® Taegis™ XDR in CEF format over syslog.
Note
This guide covers the cloud-managed Claroty xDome (sensor_type = 'Claroty xDome') product. For the on-premises Claroty Continuous Threat Detection (CTD) (sensor_type = 'Claroty') product, see the Claroty CTD integration guide.
Important
Adding this integration to your XDR tenant requires Taegis™ XDR for OT. Contact your account manager or CSM to acquire the required license.
Connectivity Requirements🔗
| Source | Destination | Port/Protocol |
|---|---|---|
| Claroty xDome collection server | Taegis™ XDR Collector (mgmt IP) | TCP/601 |
Note
Syslog events originate from the xDome collection server deployed on your network, not directly from the Claroty cloud console. The collection server must have outbound TCP connectivity on port 601 to the XDR Collector management interface.
Data Provided from Integration🔗
The following xDome event types are supported by XDR:
- Alert events
- Communication events
- Device change events
- Server incident events
- Vulnerability events
Note
xDome event types not listed above are normalized to the generic schema.
| Normalized Data | Out-of-the-Box Detections | Vendor-Specific Detections | |
|---|---|---|---|
| Claroty xDome | Thirdparty |
Note
XDR detectors are not guaranteed to be triggered, even if a data source's logs are normalized to a schema associated with a given detector. However, you can create Custom Detection Rules to generate detections based on normalized data from a data source.
Configure the Claroty xDome Platform🔗
Follow the instructions in the Claroty xDome Administration Guide to configure syslog export.
Tip
To locate the vendor's documentation, log in to the Claroty xDome dashboard and go to Help Center.
In the xDome web console, go to Settings > Integrations > Syslog and configure a new syslog target using the following values:
| Parameter | Value |
|---|---|
| Format | CEF |
| Syslog Server IP | XDR Collector (mgmt IP) |
| Port | 601 |
| Protocol | TCP |
| Message Content | All event categories (Alerts, Communications, Device Changes, Vulnerabilities, Server Incidents) |
Alert Enrichment Fields🔗
When configuring the xDome CEF export for alert events, enable all available optional enrichment fields. These fields map directly to key fields in XDR:
| xDome CEF Field | XDR Field |
|---|---|
alert_name |
Detection title |
alert_description |
Detection summary |
alert_category |
Detection category |
Important
If these optional fields are excluded from the export, XDR falls back to the alert_type_name field for the detection title, summary, and category. Detections are still normalized and visible, but with less descriptive detail. Enable all enrichment fields to ensure complete detection data in XDR.
Example Query Language Searches🔗
To search for xDome events from the last 24 hours:
FROM thirdparty WHERE sensor_type = 'Claroty xDome' and EARLIEST=-24h
To search for xDome alert events:
FROM thirdparty WHERE sensor_type = 'Claroty xDome' AND log_type = 'alert_affected_device'
To search for events that Claroty classified as high severity:
WHERE sensor_type = 'Claroty xDome' AND vendor_severity = 'High'
To search for events from a specific xDome collection server:
FROM thirdparty WHERE sensor_type = 'Claroty xDome' AND sensor_id = '10.10.10.10'
Sample Logs🔗
xDome Alert🔗
Jul 9 10:35:22 10.7.1.3 2026-07-09T10:35:21.403607+00:00 acme-xdome-collection CEF:0|Claroty|Claroty|0.0|12345|alert_affected_device|5|alert_id=12345 alert_type_name=Custom Device Alert alert_name=Custom Device Alert alert_assignees=[] alert_labels=[] alert_status=Unresolved alert_site_name=Corporate src=10.9.2.3 cs1=123 cs1Label=alert_score signature_severity=High device_asset_id=ABCDEFG device_ip_list=['10.9.2.3'] device_category=IoT device_type=Recording Server device_os=Windows 10
xDome Communication Event🔗
Apr 2 14:53:20 10.7.1.3 2024-04-02T14:53:19.503607+00:00 acme-xdome-collection CEF:0|Claroty|Claroty|0.0|1234567|comm_event|5|domain=no-mans-land.example.com src=10.9.2.3 dst=10.9.3.4 spt=61384 dpt=443 proto=TCP
xDome Device Change Event🔗
Jul 9 09:47:11 10.9.1.2 2026-07-09T09:47:10.303607+00:00 acme-xdome-collection CEF:0|Claroty|Claroty|0.0|793|device_change_event|5|device_asset_id=ABCDEFG device_ip_list=['10.9.2.3'] device_category=IoT device_type=Recording Server device_os=Windows 10 device_risk_score=High change_id=793 change_timestamp=2026-07-09T09:42:23+00:00 change_type=Offline Status Change change_description=The device Status changed from Offline to Online after 33 days
xDome Vulnerability Event🔗
May 2 16:54:55 10.7.1.3 1 2024-05-02T16:54:54.610092+00:00 acme-xdome-collection Claroty 12596 - - CEF:0|Claroty|Claroty|0.0|CVE-2021-44228 (Log4j) - BCDEFGH|vulnerability_affected_device|5|vulnerability_name=CVE-2021-44228 (Log4j) vulnerability_type=Application vulnerability_cvssv3_base_score=10.0 vulnerability_is_known_exploited=True device_asset_id=BCDEFGH device_ip_list=['10.2.4.3'] device_site_name=Corporate device_category=IT device_subcategory=Servers