> For the complete documentation index, see [llms.txt](https://docs.dispel.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dispel.com/integrate-and-administer/integrations/asset-discovery/dragos.md).

# Dragos

Connect the Dragos Platform (SiteStore) to pull discovered OT assets into Dispel, map Dragos sensors to Wickets, and keep device data and vulnerability findings in sync.

## Overview

The Dragos integration lets Dispel pull the OT assets that the Dragos Platform has discovered and bring them in as Dispel devices. You connect to your Dragos **SiteStore** once, map each Dragos sensor to a Dispel facility and Wicket, and Dispel imports the matching devices and keeps them current on a recurring sync.

Dragos is an **asset-discovery** integration. Dispel reads from Dragos — it never writes back to the platform.

In Dragos, **sensors** are the collection points monitoring your industrial network. Dispel treats each Dragos sensor as a **site** that you map to a Dispel Wicket, so assets land in the right place by sensor.

#### What Dispel imports

* Discovered assets (name, IP address, MAC address, make/model, operating system, device type) as Dispel devices.
* Observed network protocols and ports for each asset.
* A link back to the asset in Dragos, stored on the device.
* **Vulnerability findings** for each imported device — covering both hardware/firmware and software/OS issues — refreshed on every sync.

{% hint style="info" %}
**Where to find it.** Sign in as an organization administrator and open **Settings → Integrations**. Dragos appears in the **Asset Discovery / Network Visibility** section. Click **Connect** on the Dragos card to begin.
{% endhint %}

## Before you begin

You'll need the following from your Dragos SiteStore:

* An **API key** — its **API Key ID** (the identifier) and **API Key Secret**. Provision this in SiteStore.
* The **SiteStore URL** of your deployment — for example `https://customer.dragos.cloud`.

{% hint style="warning" %}
**The API Key Secret is shown only once.** Dragos displays the secret a single time when you provision the key. Copy it then — if you lose it, provision a new key. Also add Dispel's **Whitelist IP** (shown on the connection form) to your firewall allowlist so Dispel can reach SiteStore, especially for on-premise deployments.
{% endhint %}

## Connecting Dragos

1. Go to **Settings → Integrations** and click **Connect** on the Dragos card.
2. Optionally set a **Display Name** to tell this integration apart from others (you can connect more than one SiteStore).
3. Fill in the connection fields:

| Field              | Type       | Notes                                                                       |
| ------------------ | ---------- | --------------------------------------------------------------------------- |
| **SiteStore URL**  | Config     | The base URL of your Dragos SiteStore instance.                             |
| **API Key ID**     | Credential | The API key identifier from your Dragos SiteStore.                          |
| **API Key Secret** | Credential | The secret associated with the key. Stored encrypted and never shown again. |

4. Click **Test Connection** to confirm Dispel can authenticate against SiteStore. Fix any reported error before saving.
5. Click **Save**. Dispel saves the integration and immediately runs the initial sync to discover your sensors.

{% hint style="info" %}
**Your credentials are encrypted.** The API Key Secret is encrypted at rest and is never displayed again after you save. When editing later, leave credential fields blank to keep the stored values.
{% endhint %}

## Mapping sensors to Wickets

Once the initial sync finishes, open the integration to find the **Site Mapping** section. Each Dragos sensor appears as a site, and this is where you decide which sensors become Dispel devices and where they land.

> Map each vendor site to a Dispel facility and wicket. Devices from mapped sites will be synced into Dispel.

For each sensor you want to import:

1. Pick a **Facility**.
2. Pick a **Wicket**. If the facility has only one Wicket, Dispel selects it for you.
3. Click **Save Mappings & Import**.

Dispel works through each mapped sensor — you'll see per-site progress move from waiting, to fetching, to syncing, to complete — and then reports how many devices were imported (for example, **"12 devices imported"** or a breakdown of new versus already-imported devices). Imported devices appear in the mapped Wicket alongside any devices you've added manually.

## Keeping your inventory current

* Dispel **re-syncs automatically** on a recurring schedule, so newly discovered assets and changed details are picked up without any action from you.
* To pull the latest inventory immediately, open the integration and choose **Refresh**.
* To change connection details or rotate credentials, edit the integration and use **Save & Sync**. Leave credential fields blank to keep the current secret.

## Vulnerability findings

Dragos reports known vulnerabilities for the assets it monitors. After each successful sync, Dispel pulls the vulnerability findings for your imported devices — covering both hardware/firmware and software/OS issues — and attaches them to those devices, so you can see a device's known issues without leaving Dispel. Findings are refreshed every sync, and resolved findings drop off automatically.

## Connection status

Each integration shows a status so you always know where it stands:

| Status              | Meaning                                                 |
| ------------------- | ------------------------------------------------------- |
| **Not Initialized** | Saved, but the first sync hasn't run yet.               |
| **Initializing**    | Running the first sync and discovering sensors.         |
| **Ready**           | Connected and synced; mappings are applied.             |
| **Needs Refresh**   | New vendor data is available; run a refresh to pull it. |
| **Refreshing**      | A sync is in progress.                                  |
| **Pending Changes** | Mapping changes are saved but not yet applied.          |
| **Applying**        | Importing devices for your saved mappings.              |
| **Failed**          | The last operation failed — see the error guidance.     |

A separate **health badge** (Connected, Degraded, Unreachable) reflects whether Dispel can currently reach the Dragos API.

## Troubleshooting

If a sync or test connection fails, Dispel classifies the error and suggests a fix:

| Error                     | What it usually means and how to fix it                                                                                                  |
| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| **Authentication Failed** | The API Key ID/Secret was rejected. The key may have been rotated, expired, or revoked — provision a new one and update the integration. |
| **Endpoint Unreachable**  | Dispel couldn't reach SiteStore. Verify the SiteStore URL and that Dispel's IP is allowlisted in your firewall.                          |
| **Connection Timed Out**  | SiteStore took too long to respond — often network latency or a firewall rule.                                                           |
| **Rate Limited**          | Dragos throttled requests. The next scheduled sync should succeed.                                                                       |
| **Configuration Error**   | The SiteStore URL looks wrong. Re-check the connection settings.                                                                         |

## Frequently asked questions

<details>

<summary>Can I connect more than one Dragos SiteStore?</summary>

Yes. Dragos supports multiple integrations, so you can connect several SiteStore instances side by side. Give each a distinct **Display Name** to tell them apart.

</details>

<details>

<summary>What is a "site" for Dragos?</summary>

Dispel maps Dragos **sensors** to sites. Each sensor monitoring your network appears in the Site Mapping list, so you can route assets from different sensors to different facilities and Wickets.

</details>

<details>

<summary>I lost my API Key Secret. What do I do?</summary>

Dragos shows the secret only once at provisioning time. If you no longer have it, provision a new API key in SiteStore and update the integration with the new ID and secret.

</details>

<details>

<summary>Does connecting Dragos change anything in SiteStore?</summary>

No. Dispel only reads from Dragos. It never creates, modifies, or deletes data on the Dragos side.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.dispel.com/integrate-and-administer/integrations/asset-discovery/dragos.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.