Skip to main content

Claroty xDome

Claroty xDome is an OT (operational technology) security tool that provides protection across your organization against cyber threats. You can bring device information from Claroty xDome into Brinqa to construct a unified view of your attack surface and strengthen your cybersecurity posture.

This document details the information you must provide for the connector to authenticate with Claroty xDome and how to obtain that information from Claroty xDome. See create a data integration for step-by-step instructions on setting up the integration.

Required connection settings​

When setting up a data integration, select Claroty xDome from the Connector dropdown. If you cannot find the connector in the dropdown, make sure that you have installed it first. You must provide the following information to authenticate Claroty xDome with Brinqa:

  • Service URL: The Claroty xDome API URL. The default URL is https://api.medigate.io.

  • API key: The API key associated with the Claroty xDome account, which must have permissions to log in to the API server and return data.

Obtain a Claroty xDome API key​

For the Claroty xDome connector to use the Claroty API, you must create an API user and generate an API key. To do so, follow these steps:

  1. Log in to your organization's Claroty xDome portal as an administrator.

  2. Navigate to Settings > Admin Settings.

  3. In the navigation menu, click User Management, and then click Add User.

    The Create User dialog appears. Complete the following fields:

    • User Type: Select API User.

    • User Info: Enter a user name and title (description) for the API key.

      note

      This user name must be different from the Claroty xDome portal login user name.

    • Site Permissions: Click the dropdown and choose the necessary sites you want the Claroty xDome connector to have access to.

    • Roles: Click the dropdown and select Read-Only User.

    • Including future sites: (Optional) Enable this option to automatically grant access to any new sites added to your Claroty xDome environment. This ensures that the connector can retrieve data from all current and future sites without requiring manual updates to the site permissions.

      Claroty xDome new user dialog

  4. Click Create User.

  5. After creating the new user, click Generate Token.

    Claroty xDome generate token

    The Generate API token dialog appears.

  6. Click the Token Expiration dropdown and select the desired token expiry date.

  7. Click Generate.

    Your new API key displays. You can not view the key again after this. Copy and save it to a secure location.

note

If you do not have permissions to create an API key, contact your Claroty xDome administrator.

Additional settings​

The Claroty xDome connector contains additional options for specific configuration:

  • Page size: The maximum number of records to get per API request. The default setting is 100. It is not recommended to go over 100.

  • Parallel requests: The maximum number of parallel API requests. The default setting is 4.

Types of data to retrieve​

The Claroty xDome connector can retrieve the following types of data from the Claroty API:

Table 1: Data retrieved from Claroty xDome

Connector ObjectRequiredMaps to Data Model
AlertYesAlert
Alert DefinitionYesAlert Definition
DeviceYesHost
VulnerabilityYesVulnerability
Vulnerability DefinitionYesVulnerability Definition

This diagram shows how Alert and Vulnerability connector objects relate to their definitions and the Device assets they are found in.

Figure 1: Connector object relationships

info

For detailed steps on how to view the data retrieved from Claroty xDome in the Brinqa Platform, see How to view your data.

Attribute mappings​

Expand the sections below to view the mappings between the source and the Brinqa data model attributes.

Device

Table 2: Device attribute mappings

Source Field NameSDM Attribute
DeviceResource.uidUID
DeviceResource.deviceNameNAME
DeviceResource.deviceCategoryCATEGORIES
DeviceResource.retiredSTATUS
DeviceResource.ipListIP_ADDRESSES
DeviceResource.macListMAC_ADDRESSES
DeviceResource.vlanListVLANS
DeviceResource.networkListNETWORKS
DeviceResource.serialNumberSERIAL_NUMBER
DeviceResource.manufacturerMANUFACTURER
DeviceResource.combinedOsOPERATING_SYSTEM
DeviceResource.deviceNameDEVICE_NAME
DeviceResource.modelMODEL
DeviceResource.assetIdASSET_ID
DeviceResource.deviceCategoryDEVICE_CATEGORY
DeviceResource.deviceSubcategoryDEVICE_SUBCATEGORY
DeviceResource.deviceTypeDEVICE_TYPE
DeviceResource.deviceTypeFamilyDEVICE_TYPE_FAMILY
DeviceResource.combinedOsCOMBINED_OS
DeviceResource.purdueLevelPURDUE_LEVEL
DeviceResource.riskScoreRISK_SCORE
DeviceResource.riskScorePointsRISK_SCORE_POINTS
DeviceResource.criticalityCRITICALITY
DeviceResource.siteNameSITE_NAME
DeviceResource.internetCommunicationINTERNET_COMMUNICATION
DeviceResource.mobilityMOBILITY
DeviceResource.fdaClassFDA_CLASS
DeviceResource.retiredRETIRED
DeviceResource.endpointSecurityNamesENDPOINT_SECURITY_NAMES
DeviceResource.detectorNameDETECTOR_NAME
DeviceResource.noteNOTE
DeviceResource.labelsTAGS
SiteResource.locationSITE_LOCATION
SiteResource.timezoneSITE_TIMEZONE
SiteResource.countryCodeSITE_COUNTRY_CODE
DeviceResource.firstSeenList[0]FIRST_SEEN
DeviceResource.lastSeenList[0]LAST_SEEN
System-generatedLAST_CAPTURED
Alert Definition

Table 3: Alert Definition attribute mappings

Source Field NameSDM Attribute
AlertResource.alertTypeNameUID
AlertResource.alertTypeNameNAME
AlertResource.descriptionDESCRIPTION
AlertResource.category, AlertResource.alertClassCATEGORIES
MITRE technique names (ICS + Enterprise)TAGS
AlertResource.alertClassALERT_CLASS
AlertResource.statusALERT_STATUS
AlertResource.devicesCountDEVICES_COUNT
AlertResource.unresolvedDevicesCountUNRESOLVED_DEVICES_COUNT
AlertResource.detectedTimeDETECTED_AT
AlertResource.updatedTimeUPDATED_AT
AlertResource.mitreTechniqueIcsIdsMITRE_ICS_IDS
AlertResource.mitreTechniqueIcsNamesMITRE_ICS_NAMES
AlertResource.mitreTechniqueEnterpriseIdsMITRE_ENTERPRISE_IDS
AlertResource.mitreTechniqueEnterpriseNamesMITRE_ENTERPRISE_NAMES
System-generatedLAST_CAPTURED
Alert

Table 4: Alert attribute mappings

Source Field NameSDM Attribute
alertId:deviceUidUID
DeviceAlertRelationResource.deviceUidTARGETS
DeviceAlertRelationResource.alertTypeNameTYPE
DeviceAlertRelationResource.deviceAlertStatusPROVIDER_STATUS
Normalized from PROVIDER_STATUSSOURCE_STATUS
DeviceAlertRelationResource.alertLabelsTAGS
DeviceAlertRelationResource.alertCategoryALERT_CATEGORY
DeviceAlertRelationResource.alertClassALERT_CLASS
DeviceAlertRelationResource.deviceAlertDetectedTimeDETECTED_AT
DeviceAlertRelationResource.deviceAlertUpdatedTimeUPDATED_AT
System-generatedLAST_CAPTURED
Vulnerability Definition

Table 5: Vulnerability Definition attribute mappings

Source Field NameSDM Attribute
VulnerabilityResource.nameUID
VulnerabilityResource.nameNAME
VulnerabilityResource.descriptionDESCRIPTION
VulnerabilityResource.adjustedVulnerabilityScoreLevelSEVERITY
VulnerabilityResource.adjustedVulnerabilityScoreLevelSOURCE_SEVERITY
Derived from normalized severitySEVERITY_SCORE
VulnerabilityResource.vulnerabilityTypeCATEGORIES
VulnerabilityResource.vulnerabilityLabelsTAGS
VulnerabilityResource.cveIdsCVE_IDS
VulnerabilityResource.cveIdsCVE_RECORDS
VulnerabilityResource.epssScoreEPSS_SCORE
VulnerabilityResource.publishedDatePUBLISHED_DATE
VulnerabilityResource.sourceUrlSOURCE_URL
VulnerabilityResource.cvssV2VectorString, VulnerabilityResource.cvssV3VectorStringCVSS v2/v3 metrics
VulnerabilityResource.vulnerabilityTypeVULNERABILITY_TYPE
VulnerabilityResource.adjustedVulnerabilityScoreADJUSTED_SCORE
VulnerabilityResource.adjustedVulnerabilityScoreLevelADJUSTED_SCORE_LEVEL
VulnerabilityResource.isKnownExploitedIS_KNOWN_EXPLOITED
VulnerabilityResource.exploitsCountEXPLOITS_COUNT
VulnerabilityResource.affectedDevicesCountAFFECTED_DEVICES_COUNT
VulnerabilityResource.sourceNameSOURCE_NAME
VulnerabilityResource.vulnerabilityPriorityGroupPRIORITY_GROUP
System-generatedLAST_CAPTURED
Vulnerability

Table 6: Vulnerability attribute mappings

Source Field NameSDM Attribute
vulnerabilityId:deviceUidUID
DeviceVulnerabilityRelationResource.deviceUidTARGETS
DeviceVulnerabilityRelationResource.vulnerabilityNameTYPE
Derived from vulnerabilityRelevancePROVIDER_STATUS
Normalized from PROVIDER_STATUSSOURCE_STATUS
DeviceVulnerabilityRelationResource.vulnerabilityLabelsTAGS
DeviceVulnerabilityRelationResource.vulnerabilityRelevanceVULNERABILITY_RELEVANCE
DeviceVulnerabilityRelationResource.deviceVulnerabilityDetectionDateDETECTION_DATE
DeviceVulnerabilityRelationResource.deviceVulnerabilityResolutionDateRESOLUTION_DATE
DeviceVulnerabilityRelationResource.vulnerabilityAdjustedVulnerabilityScoreLevelADJUSTED_SCORE_LEVEL
System-generatedLAST_CAPTURED

Operation options​

The Claroty xDome connector supports the following operation options. See connector operation options for information about how to apply them.

Expand the sections below to view the supported operation options per connector object.

Device

Table 7: Device operation options

Connector ObjectOptionAll Possible ValuesDescriptionExample
DeviceexcludeRetiredtrue or falseExclude retired devices from sync. Default is true.Key: excludeRetired,
Value: false.
This key and value combination includes retired devices in the sync.
enrichSitestrue or falseEnable site enrichment (adds location, timezone, and country code from the /api/v1/sites/get endpoint). Default is false.Key: enrichSites,
Value: true.
This key and value combination enriches each Device with site location, timezone, and country code.
Alert Definition

Table 8: Alert Definition operation options

Connector ObjectOptionAll Possible ValuesDescriptionExample
Alert DefinitionexcludeResolvedtrue or falseExclude resolved alert definitions from sync. Default is true.Key: excludeResolved,
Value: false.
This key and value combination includes resolved alert definitions in the sync.
Alert

Table 9: Alert operation options

Connector ObjectOptionAll Possible ValuesDescriptionExample
AlertexcludeRetiredtrue or falseExclude alerts on retired devices. Default is true.Key: excludeRetired,
Value: false.
This key and value combination includes alerts on retired devices in the sync.
Vulnerability

Table 10: Vulnerability operation options

Connector ObjectOptionAll Possible ValuesDescriptionExample
VulnerabilityexcludeRetiredtrue or falseExclude vulnerabilities on retired devices. Default is true.Key: excludeRetired,
Value: false.
This key and value combination includes vulnerabilities on retired devices in the sync.
excludeIrrelevanttrue or falseExclude vulnerabilities with relevance irrelevant. Default is false.Key: excludeIrrelevant,
Value: true.
This key and value combination excludes vulnerabilities marked as irrelevant.

APIs​

The Claroty xDome connector uses the Claroty xDome API. Specifically, it uses the following endpoints:

Table 11: Claroty xDome API Endpoints

Connector ObjectAPI Endpoint
AlertPOST /api/v1/device_alert_relations/
Alert DefinitionPOST /api/v1/alerts/
DevicePOST /api/v1/devices/
VulnerabilityPOST /api/v1/device_vulnerability_relations/
Vulnerability DefinitionPOST /api/v1/vulnerabilities/

Changelog​

The Claroty xDome connector has undergone the following changes:

Table 12: Claroty xDome connector changelog

VersionDescriptionDate Published
3.0.4Improvements
- Devices discovered in Claroty xDome are now synchronized to the standard 'Host' model, aligning the connector with Brinqa's host-centric Unified Data Model. The associated asset category is also updated from Device to Host.
- Expanded the set of Host identifiers used for record matching to include serial number, MAC addresses, and IP addresses — improving deduplication when correlating xDome devices with Host records from other sources.
Migration Required
- 'Device': The target model has changed from Device to Host. Action: purge previously synced Device records from this connector and re-sync to repopulate them as Host assets.		June 4th, 2026
3.0.2Fixed an issue where the NAME attribute on the Device object was incorrectly populated with an internal UID instead of the actual device name. The connector now uses the DEVICE_NAME attribute to provide accurate device names.January 30th, 2025
3.0.1Code cleanup and general maintenance.December 26th, 2024
3.0.0Initial Integration+ release.December 26th, 2024
Last updated on