Claroty Continuous Threat Detection

About the Device

Claroty CTD is a robust solution that delivers comprehensive cybersecurity controls for industrial and government environments. A security platform that provides industrial cyber security solutions with full-spectrum IoT and OT visibility, continuous monitoring and real-time risk insights to protect you from evolving threats.

CTD monitors the network for all five signs of potential threat: 

• Early indicators of attack, such as abnormal DNS scans or failed login attempts. 

• The presence of known threat signatures

• Behavioral anomalies associated with zero-day attacks, such as atypical communication between assets

• Engineering operations associated with advanced persistent threat (APT) activity, such as unexpected process value changes

• Any activity or indicator that meets your custom-defined criteria

Device Information

Collection Method

Port Requirements

To facilitate secure communication and align with our best practice, we strongly encourage the use of Transport Layer Security (TLS) between your security devices and our Adaptive MxDR platform for event forwarding.

While we understand that TLS support may not be available on all devices, if your devices do support TLS communication, we recommend utilizing port 6514 for seamless integration.

In some cases, the upgraded version of the device might incorporate TLS support without prior notice. If you come across such a scenario or for further assistance in configuring TLS, we kindly ask you to reach out to your dedicated Adaptive MxDR Service Delivery Lead.

Device Configuration

To configure Syslog from Claroty CTD Server

1. Log in to CTD Server (need user with admin access)

2. Navigate to Settings -> Integrations -> SIEM Syslog

3. Uncheck Local as we are sending logs to another target.

   1. Below points are mapped exactly as per the reference screenshot:

      1. From (Site) – Select one or multiple sites (i.e. CTD Servers) from the dropdown.

      2. Vendor Name - Other

      3. Message Contents – Select which level to log - Alerts, Baselines, Events, or Health Monitoring. Default is Alerts.

      4. Category - Make category selected as ALL.

      5. Message Format – Select CEF

      6. Server – CyberHub IP Address

      7. Port – 6514

      8. Protocol – TLS :When TLS is chosen, the Syslog message will be sent as an encrypted TCP message with CEF format, with an option to add server authentication by uploading a server certificate.

      9. System URL – Automatically shows the source URL; this field is not editable

      10. Save – Choose to commit your entries

4. Selecting Message Content as Alerts then below screen appears. Select Category as All.

5. Selecting Message Content as Events then below screen appears. Select Category as All.

6. Selecting Message Content as Health Monitoring then below screen appears. You may tweak Interval a per your requirement.

7. Selecting Message Content as Baseline then below screen appears. Here are some important settings

   1. Protocol: Select the protocol/s you want to filter for. The drop down displays protocols that exist in the specific environment.

   2. Communication Type: Search for the types of communication you require or scroll down to select from the list of communication types.

   3. Access Type: Select from the list of available access types.

To configure Syslog from EMC Server

1. Log in to EMC (need user with admin access)

2. Navigate to Settings > Integrations > SIEM Syslog

3. Click the + to Create New. 

4. Enter the following Configuration:

   1. To: Uncheck LOCAL because we are sending logs to a remote server

   2. From: Select one or multiple CTD sites or ALL from which your want to send syslog for

   3. Vendor name: Select vendor as Other

   4. Message Contents - elect Alerts, Baselines, Events from Message Contents drop-down and configure recommended settings provided before under CTD server configuration.

   5. Message Format – Select CEF

   6. Server – CyberHub IP Address

   7. Port – 6514

   8. Protocol – TLS :When TLS is chosen, the Syslog message will be sent as an encrypted TCP message with CEF format, with an option to add server authentication by uploading a server certificate.

   9. System URL – Automatically shows the source URL; this field is not editable and does not need to be configured

   10. Save – Choose to commit your entries.

5. Once Syslog configuration gets done then click to Send a Test Message option to test the Syslog servers those were added.

Integration Parameters

Parameters required from customer for Integration.