> For the complete documentation index, see [llms.txt](https://docs.dispel.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dispel.com/integrate-and-administer/integrations/asset-discovery.md).

# Asset Discovery

Pull the OT and IoT asset inventory your security tools have already discovered into Dispel as devices. Connect Nozomi, Armis, Forescout, Dragos, TXOne, Tenable, Darktrace, or Claroty xDome and map th

## Overview

Asset-discovery integrations let Dispel pull the OT and IoT assets your security and visibility tools have already discovered and bring them in as Dispel devices. You connect a tool once, map its sites to your Dispel facilities and Wickets, and Dispel imports the matching devices and keeps them current on a recurring sync.

Every asset-discovery integration is **read-only** — Dispel reads from the vendor and never writes back.

Dispel supports eight asset-discovery integrations:

* [**Nozomi Networks**](/integrate-and-administer/integrations/asset-discovery/nozomi.md) — OT and IoT network visibility, via Vantage (cloud) or Guardian (on-premise).
* [**Armis**](/integrate-and-administer/integrations/asset-discovery/armis.md) — cloud-native discovery of managed and unmanaged assets.
* [**Forescout**](/integrate-and-administer/integrations/asset-discovery/forescout.md) — on-premise device visibility through the eyeControl Web API.
* [**Dragos**](/integrate-and-administer/integrations/asset-discovery/dragos.md) — the Dragos Platform (SiteStore), with sensors mapped to Wickets.
* [**TXOne**](/integrate-and-administer/integrations/asset-discovery/txone.md) — OT endpoints managed by the StellarOne console.
* [**Tenable OT Security**](/integrate-and-administer/integrations/asset-discovery/tenable.md) — on-premise OT asset discovery and vulnerability assessment via the Tenable appliance API.
* [**Darktrace**](/integrate-and-administer/integrations/asset-discovery/darktrace.md) — cloud discovery with behavioural detections, via the ActiveAI Security Portal.
* [**Claroty xDome**](/integrate-and-administer/integrations/asset-discovery/claroty-xdome.md) — cloud OT, IoT, and IIoT visibility via the xDome API.

{% hint style="info" %}
**Where to find them.** Sign in as an organization administrator and open [**Settings → Integrations**](https://app.dispel.com/settings/integrations). These appear in the **Asset Discovery / Network Visibility** section. Click **Connect** on a card to begin.
{% endhint %}

## How it works

Every asset-discovery integration follows the same workflow. The vendor-specific details — credentials, URLs, and what counts as a "site" — are on each integration's own page.

1. **Connect.** On the integration's card, click **Connect**, enter the vendor's API URL and credentials, and optionally a **Display Name**.
2. **Test the connection.** Click **Test Connection** to confirm Dispel can authenticate before saving.
3. **Save.** Dispel saves the integration and immediately runs an initial sync to discover the vendor's sites.
4. **Map sites to Wickets.** In the **Site Mapping** section, map each vendor site to a Dispel facility and [Wicket](/build-your-environment/infrastructure/deployment-infrastructure/wickets.md), then click **Save Mappings & Import**.
5. **Devices appear.** Imported assets show up as devices in the mapped Wickets, and Dispel re-syncs automatically on a recurring schedule (or immediately when you choose **Refresh**).

{% hint style="info" %}
**Allowlist Dispel's IP.** The connection form shows a **Whitelist IP** value. Add it to your vendor or firewall allowlist so Dispel can reach the API — especially important for on-premise appliances.
{% endhint %}

## What each integration supports

| Integration                                                                              | Connects to           | Deployment       | Site model       | Vulnerability findings | Zone filtering |
| ---------------------------------------------------------------------------------------- | --------------------- | ---------------- | ---------------- | :--------------------: | :------------: |
| [Nozomi Networks](/integrate-and-administer/integrations/asset-discovery/nozomi.md)      | Vantage / Guardian    | Cloud or on-prem | Per-site         |            ✅           |        ✅       |
| [Armis](/integrate-and-administer/integrations/asset-discovery/armis.md)                 | Armis tenant          | Cloud            | Per-site         |            ✅           |        —       |
| [Forescout](/integrate-and-administer/integrations/asset-discovery/forescout.md)         | Enterprise Manager    | On-premise       | Single appliance |            —           |        —       |
| [Dragos](/integrate-and-administer/integrations/asset-discovery/dragos.md)               | SiteStore             | Cloud or on-prem | Sensors as sites |            ✅           |        —       |
| [TXOne](/integrate-and-administer/integrations/asset-discovery/txone.md)                 | StellarOne console    | On-premise       | Single console   |            —           |        —       |
| [Tenable OT Security](/integrate-and-administer/integrations/asset-discovery/tenable.md) | OT Security appliance | On-premise       | Single appliance |            ✅           |        —       |
| [Darktrace](/integrate-and-administer/integrations/asset-discovery/darktrace.md)         | ActiveAI (master)     | Cloud            | Single instance  |           —¹           |        —       |
| [Claroty xDome](/integrate-and-administer/integrations/asset-discovery/claroty-xdome.md) | xDome API             | Cloud            | Single tenant    |            ✅           |        —       |

## Vulnerability findings

Some integrations also report known vulnerabilities for the assets they monitor. Where supported (Nozomi, Armis, Dragos, Tenable, and Claroty xDome), Dispel pulls these findings after each sync and attaches them to the imported devices, so you can see a device's known issues without leaving Dispel. Findings refresh every sync, and resolved findings drop off automatically.

¹ Darktrace contributes a different kind of finding — its behavioural Model Alerts rather than CVE-based vulnerabilities — attached to devices the same way.

## Connection status

Each integration shows a status so you always know where it stands:

| Status              | Meaning                                                 |
| ------------------- | ------------------------------------------------------- |
| **Not Initialized** | Saved, but the first sync hasn't run yet.               |
| **Initializing**    | Running the first sync and discovering sites.           |
| **Ready**           | Connected and synced; mappings are applied.             |
| **Needs Refresh**   | New vendor data is available; run a refresh to pull it. |
| **Refreshing**      | A sync is in progress.                                  |
| **Pending Changes** | Mapping changes are saved but not yet applied.          |
| **Applying**        | Importing devices for your saved mappings.              |
| **Failed**          | The last operation failed — see the error guidance.     |

A separate **health badge** (Connected, Degraded, Unreachable) reflects whether Dispel can currently reach the vendor API.

## Frequently asked questions

<details>

<summary>Can I connect more than one asset-discovery integration?</summary>

Yes. You can run several at once — and for most vendors you can connect more than one instance of the same vendor (for example, two Nozomi deployments). Give each a distinct **Display Name** to tell them apart.

</details>

<details>

<summary>Do these integrations change anything in my vendor console?</summary>

No. Every asset-discovery integration is read-only. Dispel pulls inventory and findings but never creates, modifies, or deletes data on the vendor side.

</details>

<details>

<summary>Where do imported devices go?</summary>

Into the Dispel Wicket you map each vendor site to. They appear alongside any devices you've added manually and follow the same access controls.

</details>

<details>

<summary>Who can configure these integrations?</summary>

An organization administrator, from **Settings → Integrations**.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.dispel.com/integrate-and-administer/integrations/asset-discovery.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.