You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/defender-for-iot/organizations/alerts.md
+7-1Lines changed: 7 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ ms.custom: enterprise-iot
8
8
9
9
# Microsoft Defender for IoT alerts
10
10
11
-
Microsoft Defender for IoT alerts enhance your network security and operations with real-time details about events logged in your network. Alerts are messages that a Defender for IoT engine triggers when OT or Enterprise IoT network sensors detect changes or suspicious activity in network traffic that needs your attention.
11
+
Microsoft Defender for IoT alerts enhance your network security and operations with real-time details about events logged in your network. Alerts are triggered when OT or Enterprise IoT network sensors detect changes or suspicious activity in network traffic that needs your attention.
12
12
13
13
For example:
14
14
@@ -119,6 +119,12 @@ Use the following table to learn more about each alert status and triage option.
119
119
> For more information, see [Create alert exclusion rules on an on-premises management console](how-to-accelerate-alert-incident-response.md#create-alert-exclusion-rules-on-an-on-premises-management-console).
120
120
>
121
121
122
+
### Triage OT alerts during learning mode
123
+
124
+
*Learning mode* refers to the initial period after an OT sensor is deployed, when your OT sensor learns your network's baseline activity, including the devices and protocols in your network, and the regular file transfers that occur between specific devices.
125
+
126
+
Use learning mode to perform an initial triage on the alerts in your network, *learning* those you want to mark as authorized, expected activity. Learned traffic doesn't generate new alerts the next time the same traffic is detected.
127
+
122
128
## Next steps
123
129
124
130
Review alert types and messages to help you understand and plan remediation actions and playbook integrations. For more information, see [OT monitoring alert types and descriptions](alert-engine-messages.md).
title: System architecture for OT monitoring - Microsoft Defender for IoT
2
+
title: System architecture for OT/IoT monitoring - Microsoft Defender for IoT
3
3
description: Learn about the Microsoft Defender for IoT system architecture and data flow.
4
-
ms.topic: overview
5
-
ms.date: 12/25/2022
4
+
ms.topic: conceptual
5
+
ms.date: 01/18/2023
6
6
---
7
7
8
-
# System architecture for OT system monitoring
8
+
# Microsoft Defender for IoT components
9
9
10
10
The Microsoft Defender for IoT system is built to provide broad coverage and visibility from diverse data sources.
11
11
@@ -18,38 +18,35 @@ Defender for IoT connects to both cloud and on-premises components, and is built
18
18
Defender for IoT includes the following OT security monitoring components:
19
19
20
20
-**The Azure portal**, for cloud management and integration to other Microsoft services, such as Microsoft Sentinel.
21
-
-**OT network sensors**, to detect OT devices across your network. OT network sensors are deployed on either a virtual machine or a physical appliance, and configured as cloud-connected sensors, or fully on-premises, locally managed sensors.
22
-
-**An on-premises management console** for centralized OT site management in local, air-gapped environments.
23
21
24
-
## What is a Defender for IoT committed device?
22
+
-**Operational technology (OT) or Enterprise IoT network sensors**, to detect devices across your network. Defender for IoT network sensors are deployed on either a virtual machine or a physical appliance. OT sensors can be configured as cloud-connected sensors, or fully on-premises, locally managed sensors.
-**An on-premises management console** for centralized OT sensor management and monitoring for local, air-gapped environments.
27
25
28
-
## OT network sensors
26
+
## OT and Enterprise IoT network sensors
29
27
30
-
OT network sensors discover and continuously monitor network traffic across your OT devices.
28
+
Defender for IoT network sensors discover and continuously monitor network traffic across your network devices.
31
29
32
-
- Network sensors are purpose-built for OT networks and connect to a SPAN port or network TAP. OT network sensors can provide visibility into risks within minutes of connecting to the network.
30
+
- Network sensors are purpose-built for OT/IoT networks and connect to a SPAN port or network TAP. Defender for IoT network sensors can provide visibility into risks within minutes of connecting to the network.
33
31
34
-
- Network sensors use OT-aware analytics engines and Layer-6 Deep Packet Inspection (DPI) to detect threats, such as fileless malware, based on anomalous or unauthorized activity.
32
+
- Network sensors use OT/IoT-aware analytics engines and Layer-6 Deep Packet Inspection (DPI) to detect threats, such as fileless malware, based on anomalous or unauthorized activity.
35
33
36
34
Data collection, processing, analysis, and alerting takes place directly on the sensor, which can be ideal for locations with low bandwidth or high-latency connectivity. Only telemetry and insights are transferred on for management, either to the Azure portal or an on-premises management console.
37
35
38
-
For more information, see [Onboard OT sensors to Defender for IoT](onboard-sensors.md).
39
36
40
37
### Cloud-connected vs. local OT sensors
41
38
42
39
Cloud-connected sensors are sensors that are connected to Defender for IoT in Azure, and differ from locally managed sensors as follows:
43
40
44
-
When you have a cloud connected OT network sensor:
41
+
**When you have a cloud connected OT network sensor**:
45
42
46
43
- All data that the sensor detects is displayed in the sensor console, but alert information is also delivered to Azure, where it can be analyzed and shared with other Azure services.
47
44
48
45
- Microsoft threat intelligence packages can be automatically pushed to cloud-connected sensors.
49
46
50
47
- The sensor name defined during onboarding is the name displayed in the sensor, and is read-only from the sensor console.
51
48
52
-
In contrast, when working with locally managed sensors:
49
+
**In contrast, when working with locally managed sensors**:
53
50
54
51
- View any data for a specific sensor from the sensor console. For a unified view of all information detected by several sensors, use an on-premises management console.
55
52
@@ -69,15 +66,15 @@ For example, the **policy violation detection** engine models industry control s
69
66
70
67
Since many detection algorithms were built for IT, rather than OT networks, the extra baseline for ICS networks helps to shorten the system's learning curve for new detections.
71
68
72
-
Defender for IoT network sensors include the following analytics engines:
73
-
74
-
|Name |Description |
75
-
|---------|---------|
76
-
|**Protocol violation detection engine**| Identifies the use of packet structures and field values that violate ICS protocol specifications. <br><br>For example, Modbus exceptions or the initiation of an obsolete function code alerts. |
77
-
|**Industrial malware detection engine**| Identifies behaviors that indicate the presence of known malware, such as Conficker, Black Energy, Havex, WannaCry, NotPetya, and Triton. |
78
-
|**Anomaly detection engine**| Detects unusual machine-to-machine (M2M) communications and behaviors. <br><br>This engine models ICS networks and therefore requires a shorter learning period than analytics developed for IT. Anomalies are detected faster, with minimal false positives. <br><br>For example, Excessive SMB sign-in attempts, and PLC Scan Detected alerts. |
79
-
|**Operational incident detection**| Detects operational issues such as intermittent connectivity that can indicate early signs of equipment failure. <br><br> For example, the device might be disconnected (unresponsive), or the Siemens S7 stop PLC command was sent alerts. |
69
+
Defender for IoT network sensors include the following main analytics engines:
80
70
71
+
|Name |Description | Examples |
72
+
|---------|---------|---------|
73
+
|**Protocol violation detection engine**| Identifies the use of packet structures and field values that violate ICS protocol specifications. <br><br>Protocol violations occur when the packet structure or field values don't comply with the protocol specification.| An *"Illegal MODBUS Operation (Function Code Zero)"* alert indicates that a primary device sent a request with function code 0 to a secondary device. This action isn't allowed according to the protocol specification, and the secondary device might not handle the input correctly |
74
+
|**Policy Violation**| A policy violation occurs with a deviation from baseline behavior defined in learned or configured settings. | An *"Unauthorized HTTP User Agent"* alert indicates that an application that wasn't learned or approved by policy is used as an HTTP client on a device. This might be a new web browser or application on that device.|
75
+
|**Industrial malware detection engine**| Identifies behaviors that indicate the presence of malicious network activity via known malware, such as Conficker, Black Energy, Havex, WannaCry, NotPetya, and Triton. | A *"Suspicion of Malicious Activity (Stuxnet)"* alert indicates that the sensor detected suspicious network activity known to be related to the Stuxnet malware. This malware is an advanced persistent threat aimed at industrial control and SCADA networks. |
76
+
|**Anomaly detection engine**| Detects unusual machine-to-machine (M2M) communications and behaviors. <br><br>This engine models ICS networks and therefore requires a shorter learning period than analytics developed for IT. Anomalies are detected faster, with minimal false positives. | A *"Periodic Behavior in Communication Channel"* alert reflects periodic and cyclic behavior of data transmission, which is common in industrial networks. <br>Other examples include excessive SMB sign-in attempts, and PLC scan detected alerts. |
77
+
|**Operational incident detection**| Detects operational issues such as intermittent connectivity that can indicate early signs of equipment failure. | A *"Device is Suspected to be Disconnected (Unresponsive)"* alert is triggered when a device isn't responding to any kind of request for a predefined period. This alert might indicate a device shutdown, disconnection, or malfunction. <br>Another example might be the that Siemens S7 stop PLC command was sent alerts. |
81
78
82
79
## Management options
83
80
@@ -93,15 +90,15 @@ Defender for IoT provides hybrid network support using the following management
93
90
94
91
:::image type="content" source="media/release-notes/new-interface.png" alt-text="Screenshot that shows the updated interface." lightbox="media/release-notes/new-interface.png":::
95
92
96
-
-**The on-premises management console**. In air-gapped environments, the on-premises management console provides a centralized view and management options for devices and threats detected by connected OT network sensors. The on-premises management console also lets you organize your network into separate sites and zones to support a [Zero Trust](/security/zero-trust/) mindset, and provides extra maintenance tools and reporting features.
93
+
-**The on-premises management console**. In air-gapped environments, you can get a central view of data from all of your sensors from an on-premises management console, using extra maintenance tools and reporting features.
97
94
98
-
## Next steps
95
+
The software version on your on-premises management console must be equal to that of your most up-to-date sensor version. Each on-premises management console version is backwards compatible to older, supported sensor versions, but cannot connect to newer sensor versions.
99
96
100
-
> [!div class="nextstepaction"]
101
-
> [Understand OT sensor connection methods](architecture-connections.md)
Copy file name to clipboardExpand all lines: articles/defender-for-iot/organizations/concept-sentinel-integration.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,7 +25,7 @@ Microsoft Sentinel is a scalable cloud service for security information event ma
25
25
26
26
In Microsoft Sentinel, the Defender for IoT data connector and solution brings out-of-the-box security content to SOC teams, helping them to view, analyze and respond to OT security alerts, and understand the generated incidents in the broader organizational threat contents.
27
27
28
-
Install the Defender for IoT data connector alone to stream your OT network alerts to Microsoft Sentinel. Then, also install the **Microsoft Defender for IoT** solution the extra value of IoT/OT-specific analytics rules, workbooks, and SOAR playbooks, as well as incident mappings to [MITRE ATT&CK for ICS](https://collaborate.mitre.org/attackics/index.php/Overview).
28
+
Install the Defender for IoT data connector alone to stream your OT network alerts to Microsoft Sentinel. Then, also install the **Microsoft Defender for IoT** solution the extra value of IoT/OT-specific analytics rules, workbooks, and SOAR playbooks, as well as incident mappings to [MITRE ATT&CK for ICS techniques](https://attack.mitre.org/techniques/ics/).
0 commit comments