---
title: "Integrate Dragos with Red Canary"
slug: "integrate-dragos-with-red-canary"
updated: 2026-09-09T16:09:35Z
published: 2026-09-09T16:09:35Z
canonical: "docs.redcanary.com/integrate-dragos-with-red-canary"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate Dragos with Zscaler MDR

Integrating Dragos with Zscaler MDR provides a robust defense-in-depth strategy for industrial control systems (ICS) environments. This means you can significantly enhance your ability to prevent, detect, and respond to cyberattacks targeting critical infrastructure. To integrate Dragos with Zscaler MDR, follow the procedure below from beginning to end.

## Prerequisites

- Before you connect Dragos to Zscaler MDR, make sure that Dragos is deployed and monitoring your Industrial control systems (ICS) and Operational technology (OT) environment.

## Step 1: Zscaler MDR–Create your Zscaler MDR generated URL

### Create a Zscaler MDR provided-URL to send Dragos alerts for ingestion

1. In the Zscaler MDR portal, click **Integrations**, then click **Add Integration**.

![Add a new Red Canary integration](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integrations-main.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A49Z&se=2026-11-04T16%3A02%3A49Z&sr=c&sp=r&sig=QSQneQtQrnCx8TQ0VXruC41hOrKVWTOAjy9AeAFtF00%3D)
2. Type and select Drago Platform.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/dragos.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A49Z&se=2026-11-04T16%3A02%3A49Z&sr=c&sp=r&sig=QSQneQtQrnCx8TQ0VXruC41hOrKVWTOAjy9AeAFtF00%3D)
3. Click **Configure**.
4. Enter a name for your integration.
5. Select a Display Category.
6. From the Ingest Format/Method section, select **Dragos Platform via syslog**.
7. Select **Use custom TLS server certificate for ingest over TLS?**.
8. Click **Save Configuration.**
9. Click **Edit Configuration.**
10. **Click Activate.**
11. After a few minutes, Zscaler MDR will generate a URL (Collector ID) that you will use to input into your Dragos account. Copy and then save this URL. You will use this in a later step.

**Example**: prod1-use2-1234567.prod1.collectors.redcanary.io ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/17915637757719.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A49Z&se=2026-11-04T16%3A02%3A49Z&sr=c&sp=r&sig=QSQneQtQrnCx8TQ0VXruC41hOrKVWTOAjy9AeAFtF00%3D)

## **Step 2: Command Line Terminal–Generate TLS certificates**

Generate the necessary Transport Layer Security (TLS) certificates that are used to configure the Dragos platform to send syslogs to Zscaler MDR.

> **Note**: If you are running any version before [OpenSSL (version 1.1.),](https://www.openssl.org/source/) you do not need to include the "-traditional" in the commands provided below. To learn what version of OpenSSL you currently have, enter `openssl version` in your native terminal.

1. Open your **native terminal**. ![1.1.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/6205381394839.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A49Z&se=2026-11-04T16%3A02%3A49Z&sr=c&sp=r&sig=QSQneQtQrnCx8TQ0VXruC41hOrKVWTOAjy9AeAFtF00%3D)
2. Copy and run the command below to generate a Certificate Authority (CA) Private Key:
  1. `openssl genrsa -traditional -out ca.key 2048`
3. Copy and run the command below to generate the Certificate Authority Certificate:
  1. `openssl req -new -x509 -sha256 -key ca.key -out ca.crt -days 3650`

> [!NOTE]
> **Note:** If you are prompted for a Common name, enter the host name or IP address of your Dragos environment.
4. Copy and run the command below to generate a Server Certificate Private Key:
  1. `openssl genrsa -traditional -out server.key 2048`
5. Copy and run the command below to generate a Server Certificate Signing Request:
  1. `openssl req -new -sha256 -key server.key -out server.csr`

> **Note:** If you are prompted for a Common name, enter the FQDN from [Step 1.12](https://redcanary.document360.io/docs/integrate-dragos-with-red-canary#step-1-red-canary%E2%80%93create-your-red-canary-generated-url:~:text=After%20a%20few%20minutes%2C%20Red%20Canary%20will%20generate%20a%20URL%20(Collector%20ID)%20that%20you%20will%20use%20to%20input%20into%20your%20Dragos%20account.%20Copy%20and%20then%20save%20this%20URL.%20You%20will%20use%20this%20in%20a%20later%20step.%C2%A0).
6. Copy and run the command below to generate a Server Certificate:
  1. `openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 3650 -sha256`
7. Copy and run the command below to generate a Client Certificate Private Key:
  1. `openssl genrsa -traditional -out client1.key 2048`
8. Copy and run the command below to generate a Client Certificate Signing Request:
  1. `openssl req -new -sha256 -key client1.key -out client1.csr`

> **Note:** If you are prompted for a Common name, enter the FQDN from [Step 1.12](https://redcanary.document360.io/docs/integrate-dragos-with-red-canary#step-1-red-canary%E2%80%93create-your-red-canary-generated-url:~:text=After%20a%20few%20minutes%2C%20Red%20Canary%20will%20generate%20a%20URL%20(Collector%20ID)%20that%20you%20will%20use%20to%20input%20into%20your%20Dragos%20account.%20Copy%20and%20then%20save%20this%20URL.%20You%20will%20use%20this%20in%20a%20later%20step.%C2%A0).
9. Copy and run the command below to generate a Client Certificate:
  1. `openssl x509 -req -in client1.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client1.crt -days 3650`
10. With your TLS certificates generated, log in to Zscaler MDR.

## **Step 3: Zscaler MDR–Upload custom certificates to Zscaler MDR**

Connect your custom certificates to Zscaler MDR in order to start receiving Dragos alerts.

1. In the Zscaler MDR portal, click **Integrations**. ![Add a new Red Canary integration](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integrations-main.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A49Z&se=2026-11-04T16%3A02%3A49Z&sr=c&sp=r&sig=QSQneQtQrnCx8TQ0VXruC41hOrKVWTOAjy9AeAFtF00%3D)
2. Scroll down, and then select your third-party security source.
3. Click **Edit Configuration**.
4. Upload the certificates you generated in [Step 1](https://redcanary.document360.io/docs/integrate-dragos-with-red-canary#step-1-red-canary%E2%80%93create-your-red-canary-generated-url:~:text=Canary%20generated%20URL-,Create%20a%20Red%20Canary%20provided%2DURL%20to%20send%20Dragos%20alerts%20for%20ingestion,-From%20your%20Red):
  1. **Upload a certificate file (PEM or DER)–**Upload the `server.crt`.
  2. **Upload the corresponding private key file–**Upload the `server.key`.
  3. Enter the **Private key passphrase** used to generate the server key.

> **Note**: Leave this field blank if there isn't a passphrase.
  4. **Upload the CA certificate corresponding to your certificate–**Upload the `ca.crt`.

![4.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/6205626346775.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A49Z&se=2026-11-04T16%3A02%3A49Z&sr=c&sp=r&sig=QSQneQtQrnCx8TQ0VXruC41hOrKVWTOAjy9AeAFtF00%3D)
  5. With your custom certificates uploaded, log in to Dragos.

## **Step 4: Dragos–Add and configure a destination server in Dragos**

Connect your custom certificates to Dragos in order to start sending alerts to Zscaler MDR.

1. From your Dragos dashboard, click **Admin**.
2. Under Syslog, click **Launch**.

![5.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/6205326818199.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A49Z&se=2026-11-04T16%3A02%3A49Z&sr=c&sp=r&sig=QSQneQtQrnCx8TQ0VXruC41hOrKVWTOAjy9AeAFtF00%3D)
3. Click **Servers,** and then click **Add Server**.

![6.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/6205351802647.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A49Z&se=2026-11-04T16%3A02%3A49Z&sr=c&sp=r&sig=QSQneQtQrnCx8TQ0VXruC41hOrKVWTOAjy9AeAFtF00%3D)
4. Enter a name for the server.
5. Enter a Hostname.
6. Enter a Port number.
7. From the Protocol dropdown, select **mTLS**.
8. Enter the Server Common name using the Hostname from [Step 4.5](https://redcanary.document360.io/docs/integrate-dragos-with-red-canary#step-1-red-canary%E2%80%93create-your-red-canary-generated-url:~:text=for%20the%20server.-,Enter%20a%20Hostname.,-Enter%20a%20Port).
9. Upload the certificates you generated in [Step 2](https://redcanary.document360.io/docs/integrate-dragos-with-red-canary#step-1-red-canary%E2%80%93create-your-red-canary-generated-url:~:text=Generate%20the%20necessary%20Transport%20Layer%20Security%20(TLS)%20certificates%20that%20are%20used%20to%20configure%20the%20Dragos%20platform%20to%20send%20syslogs%20to%20Red%20Canary.):
  1. **Server Certificate Or CA Certificate–**Upload the `ca.crt.`
  2. **Client Certificate**–Upload the `client1.crt`.
  3. **Client Key–**Upload the `client1.key`.
10. Leave all other fields set to their default state.
11. Click **Next: Set Template**.

![7.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/6205351822615.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A49Z&se=2026-11-04T16%3A02%3A49Z&sr=c&sp=r&sig=QSQneQtQrnCx8TQ0VXruC41hOrKVWTOAjy9AeAFtF00%3D)
12. From the Output Message Format dropdown, select **JSON**.
13. Copy and paste the following text into the Message field:

```plaintext
{"system":"Dragos Platform", "id":#{id}, "created_at":#{createdAt}, "occurred_at":#{occurredAt}, "severity":#{severity}, "cef_severity":#{cef_severity}, "original_severity":#{originalSeverity}, "summary":#{summary}, "source":#{source}, "content":#{content}, "detection_quad":#{detection_quad}, "detector_id":#{detectorId}, "matched_rule_id":#{matchedRuleId}, "reviewed":#{reviewed}, "type":#{type}, "attack_tactic":#{attack_tactic}, "attack_technique":#{attack_technique}, "asset_id":#{asset_id}, "asset_ip":#{asset_ip}, "asset_hostname":#{asset_hostname}, "asset_mac":#{asset_mac}, "asset_domain":#{asset_domain}, "src_asset_id":#{src_asset_id}, "src_asset_ip":#{src_asset_ip}, "src_asset_hostname":#{src_asset_hostname}, "src_asset_mac":#{src_asset_mac}, "src_asset_domain":#{src_asset_domain}, "dst_asset_id":#{dst_asset_id}, "dst_asset_ip":#{dst_asset_ip}, "dst_asset_hostname":#{dst_asset_hostname}, "dst_asset_mac":#{dst_asset_mac}, "dst_asset_domain":#{dst_asset_domain}}
```

![8.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/6205326974615.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A49Z&se=2026-11-04T16%3A02%3A49Z&sr=c&sp=r&sig=QSQneQtQrnCx8TQ0VXruC41hOrKVWTOAjy9AeAFtF00%3D)
14. Leave all other fields set to their default state.
15. Click **Save**.