MELTr
Home Vendors Search Download
Login
Vendors / Claroty / xDome / xDome Device Security Alert
Claroty logo

Event type

xDome Device Security Alert

OT/IoT/ICS security alerts with device context and risk scoring

Security alerts generated by Claroty xDome for OT/IoT/ICS devices including firmware vulnerabilities, unauthorized communications, policy violations, and threat detections with MITRE ATT&CK mappings.

JSON 29 fields Medium Generator

security-alerts ot-security ics industrial medical-devices vulnerability threat-detection mitre-attack
Preview Sample View Schema
CLI Install
meltr templates install claroty

Overview

What this event covers

Security alerts generated by Claroty xDome platform for industrial control systems, IoT devices, and medical equipment including vulnerability detections, unauthorized communications, policy violations, and threat indicators.

When generated

  • ›When outdated or vulnerable firmware is detected on OT/IoT devices
  • ›When unauthorized network communications are observed
  • ›When devices violate network segmentation policies
  • ›When anomalous protocol behavior is detected
  • ›When configuration changes occur on critical assets
  • ›When baseline deviations are identified
  • ›When MITRE ATT&CK techniques are observed

Security relevance

High

Compliance

NERC CIP IEC 62443 NIST Cybersecurity Framework ISA/IEC 62443 HIPAA (for medical devices) FDA Cybersecurity Guidance

Frequency notes

Moderate frequency with higher rates during business hours when security teams actively investigate alerts. Frequency increases during vulnerability scans or after new device discoveries. Critical environments may see 20-50 alerts per hour.

Resources

Docs and tools

Claroty xDome Documentation official Claroty xDome Integration - Rapid7 reference MITRE ATT&CK for ICS reference Purdue Model for ICS Security reference Claroty xDome Platform Unified platform for OT/IoT/ICS security MITRE ATT&CK Navigator Tool for visualizing ATT&CK techniques

Generation

Configuration

Base frequency
25 events/hour
Time patterns
business_hours night_hours weekend
Business hours
2.5x
Night hours
0.3x
Weekend
0.2x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

alert_assignees
Array Optional

List of users assigned to investigate this alert

Source: random_choice of common security team roles

Example ["Admin", "Security Team"]
alert_category
String Required

High-level categorization of the alert type

Source: random_choice from category list

Example Risk
Values
  • Risk Device configuration or state presents security risk
  • Threat Active threat or attack detected
  • Vulnerability Known security vulnerability identified
  • Policy Violation Device violates security policy
  • Anomaly Unusual behavior detected
alert_class
String Required

Classification of how the alert rule was created

Source: random_choice from class types

Example predefined
Values
  • predefined Built-in Claroty alert rule
  • custom User-created custom alert rule
  • user_defined Organization-specific alert definition
alert_description
String Required

Human-readable description of the security alert

Source: Dynamic template combining alert type with device count and category

Example Outdated firmware detected on 2 Medical devices
alert_id
Integer Required

Unique identifier for this alert instance

Source: random_int(1, 100000)

Example 12345
alert_labels
Array Optional

Tags applied to categorize or prioritize the alert

Source: random_choice of common priority and category labels

Example ["Top Priority", "Compliance"]
alert_type_name
String Required

Specific name of the alert rule that triggered

Source: random_choice from alert type catalog

Example Outdated Firmware
Values
  • Outdated Firmware Device running old firmware version
  • Unauthorized Communication Unexpected network traffic detected
  • Critical Vulnerability High-severity CVE detected
  • Protocol Anomaly Unusual industrial protocol behavior
  • Configuration Change Device configuration was modified
  • Baseline Deviation Behavior differs from learned baseline
  • Segmentation Violation Traffic crosses network zones improperly
  • Malware Detection Known malware indicators found
device_alert_detected_time
DateTime Required

Timestamp when the alert was first detected

Source: now() | iso8601

Format ISO 8601 with timezone
Example 2023-10-19T16:21:01+00:00
device_alert_status
String Required

Current status of the alert in the workflow

Source: random_choice from status workflow

Example Unresolved
Values
  • Unresolved Alert is active and not yet addressed
  • In Progress Alert is being investigated
  • Resolved Issue has been remediated
  • Acknowledged Alert has been reviewed but not resolved
  • False Positive Alert determined to be non-issue
device_alert_updated_time
DateTime Required

Timestamp of last update to this alert

Source: now() | iso8601

Format ISO 8601 with timezone
Example 2023-10-19T16:21:01+00:00
device_assignees
Array Optional

Users assigned to manage this device

Source: random_choice of user roles

Example ["Admin"]
device_category
String Required

High-level industry or functional category

Source: random_choice from industry categories

Example Medical
Values
  • Medical Healthcare/medical devices
  • Manufacturing Industrial manufacturing equipment
  • Energy Power generation or distribution
  • Building Automation HVAC, lighting, physical security
  • Critical Infrastructure Essential services infrastructure
device_first_seen_list
Array Required

Timestamps when device was first discovered (may have multiple discovery times)

Source: Past timestamp 1-30 days ago

Format Array of ISO 8601 timestamps
Example ["2023-10-19T16:32:04.127979+00:00"]
device_ip_list
Array Required

List of IP addresses associated with this device

Source: random_private_ip() in array

Example ["10.101.10.27"]
device_labels
Array Optional

Tags applied to categorize the device

Source: random_choice of asset classification labels

Example ["Critical Asset", "Production"]
device_last_seen_list
Array Required

Timestamps when device was last observed active

Source: Recent timestamp within last hour

Format Array of ISO 8601 timestamps
Example ["2023-10-19T16:32:01+00:00"]
device_mac_list
Array Required

List of MAC addresses for this device

Source: fake.mac_address()

Format Colon-separated MAC addresses
Example ["00:40:9d:10:15:b7"]
device_network_list
Array Required

Network segments where device is located

Source: random_choice of network zone names

Example ["Corporate"]
device_purdue_level
String Required

Purdue Model level classification for OT/ICS environments

Source: random_choice from Purdue levels

Example Level 4
Values
  • Level 0 Physical process (sensors, actuators)
  • Level 1 Intelligent devices (PLCs, RTUs)
  • Level 2 Control systems (SCADA, DCS)
  • Level 3 Operations management
  • Level 4 Business planning (ERP, MES)
  • Level 5 Enterprise network
device_retired
Boolean Required

Whether device is marked as decommissioned

Source: Weighted choice favoring false (75%)

Example false
device_risk_score
String Required

Calculated risk level for this device

Source: random_choice from risk levels

Example Very Low
Values
  • Very Low Minimal security risk
  • Low Limited risk exposure
  • Medium Moderate risk requiring attention
  • High Significant risk requiring remediation
  • Critical Severe risk requiring immediate action
device_site_name
String Required

Physical location or facility name

Source: random_choice from facility names

Example New York General Hospital
device_subcategory
String Required

Specific device type within the category

Source: random_choice aligned with device_category

Example Patient Devices
device_type
String Required

Specific model or function of the device

Source: random_choice from device type catalog

Example Patient Monitor
device_uid
String Required

Unique identifier for the device in Claroty xDome

Source: random_guid()

Format UUID
Example f342efb7-4f4a-4ac0-8045-0711fb2c5528
mitre_technique_enterprise_ids
Array Optional

MITRE ATT&CK Enterprise technique IDs associated with this alert

Source: random_choice of common ICS-related Enterprise techniques

Example ["T1190", "T1133"]
mitre_technique_enterprise_names
Array Optional

Human-readable names for Enterprise MITRE techniques

Source: Corresponds to mitre_technique_enterprise_ids

Example ["Exploit Public-Facing Application"]
mitre_technique_ics_ids
Array Optional

MITRE ATT&CK ICS technique IDs associated with this alert

Source: random_choice of ICS-specific MITRE techniques

Example ["T0883", "T0885"]
mitre_technique_ics_names
Array Optional

Human-readable names for ICS MITRE techniques

Source: Corresponds to mitre_technique_ics_ids

Example ["Internet Accessible Device"]