Clarifying source device in alerts

Author: limwainstein

articles/defender-for-iot/organizations/alert-engine-messages.md

@@ -86,7 +86,7 @@ The policy engine alerts table contains the **Aggregated** item to indicate that
 | **Beckhoff Software Changed** | Firmware was updated on a source device. This might be authorized activity, for example a planned maintenance procedure. | Medium | Firmware Change | **Tactics:** <br> - Inhibit Response Function <br> - Persistence <br><br> **Techniques:** <br> - T0857: System Firmware | Learnable | No |
 | **Database Login Failed** | A failed sign-in attempt was detected from a source device to a destination server. This might be the result of human error, but could also indicate a malicious attempt to compromise the server or data on it. <br><br> Threshold: 2 sign-in failures in 5 minutes | Medium | Authentication | **Tactics:** <br> - Lateral Movement <br> - Collection <br><br> **Techniques:** <br> - T0812: Default Credentials <br> - T0811: Data from Information Repositories| Not learnable | No |
 | **Emerson ROC Firmware Version Changed** | Firmware was updated on a source device. This might be authorized activity, for example a planned maintenance procedure. | Medium | Firmware Change | **Tactics:** <br> - Inhibit Response Function <br> - Persistence <br><br> **Techniques:** <br> - T0857: System Firmware | Learnable | Yes |
-| **External address within the network communicated with Internet** | A source device defined as part of your network is communicating with Internet addresses. The source isn't authorized to communicate with Internet addresses. | High | Internet Access | **Tactics:** <br> - Initial Access <br><br> **Techniques:** <br> - T0883: Internet Accessible Device | Learnable| No |
+| **External address within the network communicated with Internet** | An Internet device communicated with another Internet device within the network. | High | Internet Access | **Tactics:** <br> - Initial Access <br><br> **Techniques:** <br> - T0883: Internet Accessible Device | Learnable| No |
 | **Field Device Discovered Unexpectedly** | A new source device was detected on the network but isn't authorized. | Medium | Discovery | **Tactics:** <br> - Discovery <br><br> **Techniques:** <br> - T0842: Network Sniffing | Not learnable | No |
 | **Firmware Change Detected** | Firmware was updated on a source device. This might be authorized activity, for example a planned maintenance procedure. | Medium | Firmware Change | **Tactics:** <br> - Inhibit Response Function <br> - Persistence <br><br> **Techniques:** <br> - T0857: System Firmware | Not learnable| No |
 | **Firmware Version Changed** | Firmware was updated on a source device. This might be authorized activity, for example a planned maintenance procedure. | Medium | Firmware Change | **Tactics:** <br> - Inhibit Response Function <br> - Persistence <br><br> **Techniques:** <br> - T0857: System Firmware | Learnable| Yes |
@@ -96,7 +96,7 @@ The policy engine alerts table contains the **Aggregated** item to indicate that
 | **GOOSE Message Type Settings** | Message (identified by protocol ID) settings were changed on a source device. | Low | Unauthorized Communication Behavior | **Tactics:** <br> - Impair Process Control <br><br> **Techniques:** <br> - T0836: Modify Parameter | Learnable | Yes |
 | **Honeywell Firmware Version Changed** | Firmware was updated on a source device. This might be authorized activity, for example a planned maintenance procedure. | Medium | Firmware Change | **Tactics:** <br> - Inhibit Response Function <br> - Persistence <br><br> **Techniques:** <br> - T0857: System Firmware | Learnable| No |
 | **Illegal HTTP Communication [*](#ot-alerts-turned-off-by-default)** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Medium | Abnormal HTTP Communication Behavior | **Tactics:** <br> - Discovery <br><br> **Techniques:** <br> - T0846: Remote System Discovery | Learnable | No  |
-| **Internet Access Detected** | A source device defined as part of your network is communicating with Internet addresses. The source isn't authorized to communicate with Internet addresses. | Medium | Internet Access | **Tactics:** <br> - Initial Access <br><br> **Techniques:** <br> - T0883: Internet Accessible Device | Learnable | No |
+| **Internet Access Detected** | An internal device made an unexpected attempt to perform an outbound internet connection. | Medium | Internet Access | **Tactics:** <br> - Initial Access <br><br> **Techniques:** <br> - T0883: Internet Accessible Device | Learnable | No |
 | **Mitsubishi Firmware Version Changed** | Firmware was updated on a source device. This might be authorized activity, for example a planned maintenance procedure. | Medium | Firmware Change | **Tactics:** <br> - Inhibit Response Function <br> - Persistence <br><br> **Techniques:** <br> - T0857: System Firmware | Learnable | No |
 | **Modbus Address Range Violation** | A primary device requested access to a new secondary memory address. | Medium | Unauthorized Communication Behavior | **Tactics:** <br> - Discovery <br><br> **Techniques:** <br> - T0842: Network Sniffing | Learnable | Yes |
 | **Modbus Firmware Version Changed** | Firmware was updated on a source device. This might be authorized activity, for example a planned maintenance procedure. | Medium | Firmware Change | **Tactics:** <br> - Inhibit Response Function <br> - Persistence <br><br> **Techniques:** <br> - T0857: System Firmware | Learnable | No |
@@ -143,7 +143,7 @@ The policy engine alerts table contains the **Aggregated** item to indicate that
 | **Unauthorized HTTP Activity** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Medium | Abnormal HTTP Communication Behavior | **Tactics:** <br> - Initial Access <br> - Command And Control <br><br> **Techniques:** <br> - T0822: External Remote Services <br> - T0869: Standard Application Layer Protocol | Learnable | No |
 | **Unauthorized HTTP SOAP Action [*](#ot-alerts-turned-off-by-default)** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Medium | Abnormal HTTP Communication Behavior | **Tactics:** <br> - Command And Control <br> - Execution <br><br> **Techniques:** <br> - T0869: Standard Application Layer Protocol <br> - T0871: Execution through API | Learnable | No |
 | **Unauthorized HTTP User Agent [*](#ot-alerts-turned-off-by-default)** | An unauthorized application was detected on a source device. The application isn't authorized as a learned application on your network. | Medium | Abnormal HTTP Communication Behavior | **Tactics:** <br> - Command And Control <br><br> **Techniques:** <br> - T0869: Standard Application Layer Protocol | Learnable | No |
-| **Unauthorized Internet Connectivity Detected** | A source device defined as part of your network is communicating with Internet addresses. The source isn't authorized to communicate with Internet addresses. | High | Internet Access | **Tactics:** <br> - Initial Access <br><br> **Techniques:** <br> - T0883: Internet Accessible Device | Learnable | No |
+| **Unauthorized Internet Connectivity Detected** | An internal device successfully communicated with the internet.  | High | Internet Access | **Tactics:** <br> - Initial Access <br><br> **Techniques:** <br> - T0883: Internet Accessible Device | Learnable | No |
 | **Unauthorized Mitsubishi MELSEC Command** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Medium | Unauthorized Communication Behavior | **Tactics:** <br> - Impair Process Control <br> - Execution <br><br> **Techniques:** <br> - T0855: Unauthorized Command Message <br> - T0821: Modify Controller Tasking | Learnable | Yes |
 | **Unauthorized MMS Program Access** | A source device attempted to access a resource on another device. An access attempt to this resource between these two devices isn't authorized as learned traffic on your network. | Medium | Programming | **Tactics:** <br> - Impair Process Control <br> - Execution <br><br> **Techniques:** <br> - T0855: Unauthorized Command Message <br> - T0821: Modify Controller Tasking | Learnable | Yes |
 | **Unauthorized MMS Service** | New traffic parameters were detected. This parameter combination isn't authorized as learned traffic on your network. The following combination is unauthorized. | Medium | Unauthorized Communication Behavior | **Tactics:** <br> - Impair Process Control <br> - Execution <br><br> **Techniques:** <br> - T0855: Unauthorized Command Message <br> - T0821: Modify Controller Tasking | Learnable | Yes |