Dragos WorldView

Dragos WorldView Threat Intelligence provides actionable insights tailored for Operational Technology (OT) environments and Industrial Control Systems (ICS). It is utilized in Security Operations Centers (SOCs), boardrooms, and critical infrastructure facilities such as electric grids, oil and gas pipelines, water treatment plants, and manufacturing sites. By delivering intelligence on emerging adversary operations, Dragos WorldView enables security teams to proactively defend against threats in industrial environments. For detailed information, please refer to the Dragos’s official documentation.

Integration Method: API

Tables: OSINT Inventory Info (5021)

This integration supports the following type of events.

This integration supports the following versions.

Note:

Dragos WorldView doesn’t follow a traditional versioning system. Instead, it is a continuously updated cloud service.

Prerequisites

• The user should have access to the Dragos portal.

• The user should have access to the DataBee console.

Configuration Overview

1. Create an API Credentials with required permissions to fetch the data.

2. Create Dragos WorldView data feed in the DataBee console with the required Client credentials.

   DataBee Parameter	Dragos Parameter
   Access Key	API Access Token
   Secret Key	API Secret Key

Dragos Configuration

1. Log in to Dragos Portal.

2. Click on the Profile icon in the top-right corner.
    

3. Click on Account Settings from the dropdown.
    

4. From Account Settings, click on API.
    

5. From API section, select Generate New Keys.
    

6. From the “Generate New Token” confirmation page, select Yes, Generate New Token.
    

7. The API credentials are now generated and ready for use.
    

8. To use the generated credentials, click on the view icon and copy the credentials for later use.
    

   Note:

   Ensure that the API Access Token and API Secret Key are stored securely in a safe location for future reference.

DataBee Configuration

1. Login to the DataBee UI, navigate to Data > Data Feeds and click the Add New Data Feed button.
    

2. Search for the Dragos WorldView and click it as shown below.
    

3. Click on the API Ingest option for collection method.
    

4. Enter feed contact information and click Next.
    

5. In the configuration page, confirm the following:

   • API Base URL: This is the base URL that DataBee will interact with.

   • Authorization Method: Custom API Key

   • Access Key: Paste the API Access Token generated earlier.

   • Secret Key: Paste the API Secret Key generated earlier

   • Event Types: Preselected for all the event types that integration pulls.
      

6. Click Submit.

Troubleshooting Tips

• If you are facing unauthorized error, it might be due to incorrect credentials. Please ensure that the API Access Token and API Secret Key are pasted correctly.

• If you are facing a Too Many Requests error, this might be due to exceeding the rate limit. To fix this error follow the following steps:

  1. Navigate to API section page through the above mentioned steps.

  2. From the API section page, click on RESET RATE LIMIT to reset the rate limit counter.
      

  3. From the pop-up box click on Ok.