Query Focused Datasets

The report outlines how Query Focused Datasets (QFDs) in the Dragos Platform enable faster, more effective threat hunting and investigations by aggregating, normalizing, and enriching data across ICS environments, improving context and searchability (e.g., correlating RDP/VNC with physical access logs). It showcases the Producer-Consumer Ratio (PCR) for identifying potential data exfiltration and demonstrates how QFDs complement playbooks and threat behavior analytics—such as detecting living-off-the-land techniques—to quickly scope, pivot, and escalate suspicious activity.