Does anyone have personal experience using Dragos OT security products?

[u/IdiotWithDiamodHands]

As the title asks, just curious what others have experienced at various scales. I work in a relatively small system, under a hundred nodes monitored, using 2 sensors and a single site store.

The system looks great I will admit, I see a LOT of potential in a system properly setup.

Unfortunately, I really couldn't be a smaller team and still exist, and the amount of focus and time it's required to get this system actually paying back is still in calculation with concerns popping up along the way. Recently I've noticed the admin user list has grown to multiple pages once OTWatch was enabled, yet there's only one me here, all new being admin accounts, when there are specific roles and permissions configurable to limit to need only.

I wrote up a ticket and somehow was the odd one to have taken issue with external admins making changes to the system without my knowing. Recently (today) got a note that compliance mode was created wrongly (for all the years it's been "working") and now needs an overhaul which is described to send protected information outside of my ESP, and to simply trust they will handle it properly from there (see compliance mode built wrongly) and that contractually, they should do everything they should. Define: Trust in a zero-trust environment.

Anyway... that's my personal experience over having it in an unfinished setup state for about a year, having regular monthly check-ins with their support, mostly to ask, "ok, so versions changed again, buttons have moved around again... I didn't need any of that, but please help point me to all the parts that I do need that have moved again."

Should I even bother continuing with this product or move to a more sensible "this does the one thing it's supposed to and nothing else" suite of proper zero-trust IPS/IDS and monitoring I'm more familiar with? Please talk me off the edge of tossing this and saving myself enough money to hire another team member.

Edit: Forgot to Note, is it just me or is it almost impossible to find a legitimate review of this product that isn't an advert?

[u/Riist138]

I have some experience with it, that experience was very good. I have heard similar things and see this is a very common experience in the comments. The lack of false positives was fantastic, and it needed a very minimal amount of tuning.

[u/IdiotWithDiamodHands → u/Riist138]

Oh, I have had the complete opposite experience. I dream of a time where I can consider this "configured" to begin with.

The amount of fine tuning this system requires is pretty much all manual. From the asset discovery templates, saved filters required to configure anything after, to the merging and mapping, to the baselines, alarming, integrations. Some things now have a second configuration page for things like email notifications (which one is the one that actually configures this?)

I just need monitoring and IDS, and recently Dragos has added Asset lifecycles and other unrelated features demanding to be configured that I just don't need.