Using Trend Analysis to Operationalize OT Threat Intelligence with Neighborhood Keeper
Summary: Dragos added a "Trend Insights" tab to the main page of its Neighborhood Keeper portal, consolidating trending detections and indicators of compromise with their percentage change into a single view with stacked panels for 7, 30, and 180 days. The blog describes using that data to contextualize detections seen in a participant's own OT environment and to build threat hunting hypotheses, such as pairing community reconnaissance trends with reported phishing emails to hunt at IT/OT interconnects like jump boxes, engineering workstations, and historians.
Bottom line: The blog's own example has an adversary phishing employees for initial access to IT and pivoting into OT - and the recommended hunt targets the jump boxes, engineering workstations, and historians that sit on that path, so the value of the trend data depends on whether anyone is watching those interconnects.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026