Skip to content

Commit 80c71f1

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #227891 from batamig/patch-303
refreshing device map docs
2 parents 77aa18a + 16a5b11 commit 80c71f1

28 files changed

+337
-625
lines changed

‎.openpublishing.redirection.defender-for-iot.json

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,15 @@
11
{
22
"redirections": [
3+
{
4+
"source_path_from_root": "/articles/defender-for-iot/organizations/how-to-work-with-device-notifications.md",
5+
"redirect_url": "/azure/defender-for-iot/organizations/how-to-work-with-the-sensor-device-map#manage-device-notifications-from-an-ot-sensor-device-map",
6+
"redirect_document_id": false
7+
},
8+
{
9+
"source_path_from_root": "/articles/defender-for-iot/organizations/how-to-view-information-per-zone.md",
10+
"redirect_url": "/azure/defender-for-iot/organizations/how-to-work-with-the-sensor-device-map#view-a-device-map-for-a-specific-zone",
11+
"redirect_document_id": false
12+
},
313
{
414
"source_path_from_root": "/articles/defender-for-iot/organizations/resources-training-sessions.md",
515
"redirect_url": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-iot-blog/microsoft-defender-for-iot-ninja-training/ba-p/2428899",

‎articles/defender-for-iot/organizations/TOC.yml

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,8 @@
7878
href: ot-virtual-appliances.md
7979
- name: Supported protocols
8080
href: concept-supported-protocols.md
81+
- name: Defender for IoT device inventory
82+
href: device-inventory.md
8183
- name: Defender for IoT alerts
8284
href: alerts.md
8385
- name: Monitoring OT threats in enterprise SOCs
@@ -104,8 +106,6 @@
104106
displayName: devices, assets, inventory, device
105107
- name: View OT device mapping
106108
href: how-to-work-with-the-sensor-device-map.md
107-
- name: View OT devices per zone
108-
href: how-to-view-information-per-zone.md
109109
- name: Manage alerts
110110
items:
111111
- name: Azure portal
@@ -285,8 +285,6 @@
285285
href: how-to-manage-sensors-from-the-on-premises-management-console.md
286286
- name: Enrich device information
287287
items:
288-
- name: Work with device notifications
289-
href: how-to-work-with-device-notifications.md
290288
- name: Enhance port and VLAN name resolution
291289
href: how-to-enhance-port-and-vlan-name-resolution.md
292290
- name: Import device information

‎articles/defender-for-iot/organizations/device-inventory.md

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
---
2+
title: Device inventory - Microsoft Defender for IoT
3+
description: Learn about the Defender for IoT device inventory features available from the Azure portal, OT sensor console, and the on-premises management console.
4+
ms.date: 02/19/2023
5+
ms.topic: conceptual
6+
---
7+
8+
# Defender for IoT device inventory
9+
10+
Defender for IoT's device inventory helps you identify details about specific devices, such as manufacturer, type, serial number, firmware, and more. Gathering details about your devices helps your teams proactively investigate vulnerabilities that can compromise your most critical assets.
11+
12+
- **Manage all your IoT/OT devices** by building up-to-date inventory that includes all your managed and unmanaged devices
13+
14+
- **Protect devices with risk-based approach** to identify risks such as missing patches, vulnerabilities and prioritize fixes based on risk scoring and automated threat modeling
15+
16+
- **Update your inventory** by deleting irrelevant devices and adding organization-specific information to emphasize your organization preferences
17+
18+
For example:
19+
20+
:::image type="content" source="media/device-inventory/azure-device-inventory.png" alt-text="Screenshot of the Defender for IoT Device inventory page in the Azure portal." lightbox="media/device-inventory/azure-device-inventory.png":::
21+
22+
## Device management options
23+
24+
The Defender for IoT device inventory is available in the Azure portal, OT network sensor consoles, and the on-premises management console.
25+
26+
While you can view device details from any of these locations, each location also offers extra device inventory support. The following table describes the device inventory visible supported for each location and the extra actions available from that location only:
27+
28+
|Location |Description | Extra inventory support |
29+
|---------|---------|---------|
30+
|**Azure portal** | Devices detected from all cloud-connected OT sensors and Enterprise IoT sensors. <br><br> | - If you have an [Enterprise IoT plan](eiot-defender-for-endpoint.md) on your Azure subscription, the device inventory also includes devices detected by Microsoft Defender for Endpoint agents. <br><br>- If you also use [Microsoft Sentinel](iot-solution.md), incidents in Microsoft Sentinel are linked to related devices in Defender for IoT. <br><br>- Use Defender for IoT [workbooks](workbooks.md) for visibility into all cloud-connected device inventory, including related alerts and vulnerabilities. |
31+
|**OT network sensor consoles** | Devices detected by that OT sensor | - View all detected devices across a network device map<br>- View related events on the **Event timeline** |
32+
|**An on-premises management console** | Devices detected across all connected OT sensors | Enhance device data by importing data manually or via script |
33+
34+
For more information, see:
35+
36+
- [Manage your device inventory from the Azure portal](how-to-manage-device-inventory-for-organizations.md)
37+
- [Manage your OT device inventory from a sensor console](how-to-investigate-sensor-detections-in-a-device-inventory.md)
38+
- [Manage your OT device inventory from an on-premises management console](how-to-investigate-all-enterprise-sensor-detections-in-a-device-inventory.md)
39+
40+
> [!NOTE]
41+
> If you have an [Enterprise IoT plan](eiot-defender-for-endpoint.md) to [integrate with Microsoft Defender for Endpoint](concept-enterprise.md), devices detected by an Enterprise IoT sensor are also listed in Defender for Endpoint. For more information, see:
42+
>
43+
> - [Defender for Endpoint device inventory](/microsoft-365/security/defender-endpoint/machines-view-overview)
44+
> - [Defender for Endpoint device discovery](/microsoft-365/security/defender-endpoint/device-discovery)
45+
>
46+
47+
## Supported devices
48+
49+
Defender for IoT's device inventory supports device types across a variety of industries and fields.
50+
51+
|Devices |For example ... |
52+
|---------|---------|
53+
|**Manufacturing**| Industrial and operational devices, such as pneumatic devices, packaging systems, industrial packaging systems, industrial robots |
54+
|**Building** | Access panels, surveillance devices, HVAC systems, elevators , smart lighting systems |
55+
|**Health care** | Glucose meters, monitors |
56+
|**Transportation / Utilities** | Turnstiles, people counters, motion sensors, fire and safety systems, intercoms |
57+
|**Energy and resources** | DCS controllers, PLCs, historian devices, HMIs |
58+
|**Endpoint devices** | Workstations, servers, or mobile devices |
59+
| **Enterprise** | Smart devices, printers, communication devices, or audio/video devices |
60+
| **Retail** | Barcode scanners, humidity sensor, punch clocks |
61+
62+
A *transient* device type indicates a device that was detected for only a short time. We recommend investigating these devices carefully to understand their impact on your network.
63+
64+
*Unclassified* devices are devices that don't otherwise have an out-of-the-box category defined.
65+
66+
67+
## Unauthorized devices
68+
69+
When you're first working with Defender for IoT, during the learning period just after deploying a sensor, all devices detected are identified as *authorized* devices.
70+
71+
After the learning period is over, any new devices detected are considered to be *unauthorized* and *new* devices. We recommend checking these devices carefully for risks and vulnerabilities. For example, in the Azure portal, filter the device inventory for `Authorization == **Unauthorized**`. On the device details page, drill down and check for related vulnerabilities, alerts, and recommendations.
72+
73+
The *new* status is removed as soon as you edit any of the device details move the device on an OT sensor device map. In contrast, the *unauthorized* label remains until you manually edit the device details and mark it as *authorized*.
74+
75+
On an OT sensor, unauthorized devices are also included in the following reports:
76+
77+
- [Attack vector reports](how-to-create-attack-vector-reports.md): Devices marked as *unauthorized* are included in an attack vector simulation as suspected rogue devices that might be a threat to the network.
78+
79+
- [Risk assessment reports](how-to-create-risk-assessment-reports.md): Devices marked as *unauthorized* are listed in risk assessment reports as their risks to your network require investigation.
80+
81+
## Important OT devices
82+
83+
Mark OT devices as *important* to highlight them for extra tracking. On an OT sensor, important devices are included in the following reports:
84+
85+
- [Attack vector reports](how-to-create-attack-vector-reports.md): Devices marked as *important* are included in an attack vector simulation as possible attack targets.
86+
87+
- [Risk assessment reports](how-to-create-risk-assessment-reports.md): Devices marked as *important* are counted in risk assessment reports when calculating security scores
88+
89+
## Device inventory column data
90+
91+
The following table lists the columns available in the Defender for IoT device inventory on the Azure portal. Starred items **(*)** are also available from the OT sensor.
92+
93+
|Name |Description
94+
|---------|---------|
95+
|**Authorization** * |Editable. Determines whether or not the device is marked as *authorized*. This value may need to change as the device security changes. |
96+
|**Business Function** | Editable. Describes the device's business function. |
97+
| **Class** | Editable. The device's class. <br>Default: `IoT` |
98+
|**Data source** | The source of the data, such as a micro agent, OT sensor, or Microsoft Defender for Endpoint. <br>Default: `MicroAgent`|
99+
|**Description** * | Editable. The device's description. |
100+
| **Device Id** | The device's Azure-assigned ID number|
101+
| **Firmware model** | The device's firmware model.|
102+
| **Firmware vendor** | Editable. The vendor of the device's firmware. |
103+
| **Firmware version** * |Editable. The device's firmware version. |
104+
|**First seen** * | The date and time the device was first seen. Shown in `MM/DD/YYYY HH:MM:SS AM/PM` format. On the OT sensor, shown as **Discovered**.|
105+
|**Importance** | Editable. The device's important level: `Low`, `Medium`, or `High`. |
106+
| **IPv4 Address** | The device's IPv4 address. |
107+
|**IPv6 Address** | The device's IPv6 address.|
108+
|**Last activity** * | The date and time the device last sent an event through to Azure or to the OT sensor, depending on where you're viewing the device inventory. Shown in `MM/DD/YYYY HH:MM:SS AM/PM` format. |
109+
|**Location** | Editable. The device's physical location. |
110+
| **MAC Address** * | The device's MAC address. |
111+
|**Model** *| Editable The device's hardware model. |
112+
|**Name** * | Mandatory, and editable. The device's name as the sensor discovered it, or as entered by the user. |
113+
|**OS architecture** | Editable. The device's operating system architecture. |
114+
|**OS distribution** | Editable. The device's operating system distribution, such as Android, Linux, and Haiku. |
115+
|**OS platform** * | Editable. The device's operating system, if detected. On the OT sensor, shown as **Operating System**. |
116+
|**OS version** | Editable. The device's operating system version, such as Windows 10 or Ubuntu 20.04.1. |
117+
|**PLC mode** * | The device's PLC operating mode, including both the *Key* state (physical / logical) and the *Run* state (logical). If both states are the same, then only one state is listed.<br><br>- Possible *Key* states include: `Run`, `Program`, `Remote`, `Stop`, `Invalid`, and `Programming Disabled`. <br><br>- Possible *Run* states are `Run`, `Program`, `Stop`, `Paused`, `Exception`, `Halted`, `Trapped`, `Idle`, or `Offline`. |
118+
|**Programming device** * | Editable. Defines whether the device is defined as a *Programming Device*, performing programming activities for PLCs, RTUs, and controllers, which are relevant to engineering stations. |
119+
|**Protocols** *| The protocols that the device uses. |
120+
| **Purdue level** | Editable. The Purdue level in which the device exists.|
121+
|**Scanner device** * | Editable. Defines whether the device performs scanning-like activities in the network. |
122+
|**Sensor**| The sensor the device is connected to. |
123+
|**Serial number** *| The device's serial number. |
124+
| **Site** | The device's site. <br><br>All Enterprise IoT sensors are automatically added to the **Enterprise network** site. |
125+
| **Slots** | The number of slots the device has. |
126+
| **Subtype** | Editable. The device's subtype, such as *Speaker* or *Smart TV*. <br>**Default**: `Managed Device` |
127+
| **Tags** | Editable. The device's tags. |
128+
|**Type** * | Editable. The device type, such as *Communication* or *Industrial*. <br>**Default**: `Miscellaneous` |
129+
|**Vendor** *| The name of the device's vendor, as defined in the MAC address. |
130+
| **VLAN** * | The device's VLAN. |
131+
|**Zone** | The device's zone. |
132+
133+
The following columns are available on OT sensors only:
134+
135+
- The device's **DHCP Address**
136+
- The device's **FQDN** address and **FQDN Last Lookup Time**
137+
- The device **Groups** that include the device, as [defined on the OT sensor's device map](how-to-work-with-the-sensor-device-map.md#create-a-custom-device-group)
138+
- The device's **Module address**
139+
- The device's **Rack** and **Slot**
140+
- The number of **Unacknowledged Alerts** alerts associated with the device
141+
142+
> [!NOTE]
143+
> The additional **Agent type** and **Agent version** columns are used for by device builders. For more information, see [Microsoft Defender for IoT for device builders documentation](/azure/defender-for-iot/device-builders/).
144+
145+
## Next steps
146+
147+
For more information, see:
148+
149+
- [Manage your device inventory from the Azure portal](how-to-manage-device-inventory-for-organizations.md)
150+
- [Manage your OT device inventory from a sensor console](how-to-investigate-sensor-detections-in-a-device-inventory.md)
151+
- [Manage your OT device inventory from an on-premises management console](how-to-investigate-all-enterprise-sensor-detections-in-a-device-inventory.md)
152+
- [Microsoft Defender for IoT - supported IoT, OT, ICS, and SCADA protocols](concept-supported-protocols.md)
153+
- [Investigate devices on a device map](how-to-work-with-the-sensor-device-map.md)

‎articles/defender-for-iot/organizations/how-to-activate-and-set-up-your-sensor.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -226,7 +226,7 @@ You can access console tools from the side menu. Tools help you:
226226
| Tools| Description |
227227
| -----------|--|
228228
| Overview | View a dashboard with high-level information about your sensor deployment, alerts, traffic, and more. |
229-
| Device map | View the network devices, device connections, Purdue levels, and device properties in a map. Various zoom, highlight, and filter options are available to help you gain the insight you need. For more information, see [Investigate sensor detections in the Device Map](how-to-work-with-the-sensor-device-map.md#investigate-sensor-detections-in-the-device-map). |
229+
| Device map | View the network devices, device connections, Purdue levels, and device properties in a map. Various zoom, highlight, and filter options are available to help you gain the insight you need. For more information, see [Investigate devices on a device map](how-to-work-with-the-sensor-device-map.md) |
230230
| Device inventory | The Device inventory displays a list of device attributes that this sensor detects. Options are available to: <br /> - Sort, or filter the information according to the table fields, and see the filtered information displayed. <br /> - Export information to a CSV file. <br /> - Import Windows registry details. For more information, see [Detect Windows workstations and servers with a local script](detect-windows-endpoints-script.md).|
231231
| Alerts | Alerts are triggered when sensor engines detect changes or suspicious activity in network traffic that requires your attention. For more information, see [View and manage alerts on your OT sensor](how-to-view-alerts.md).|
232232

‎articles/defender-for-iot/organizations/how-to-enhance-port-and-vlan-name-resolution.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ For more information, see [On-premises users and roles for OT monitoring with De
2121

2222
Defender for IoT automatically assigns names to most universally reserved ports, such as DHCP or HTTP. However, you might want to customize the name of a specific port to highlight it, such as when you're watching a port with unusually high detected activity.
2323

24-
Port names are shown in Defender for IoT when [viewing device groups from the OT sensor's device map](how-to-work-with-the-sensor-device-map.md#group-highlight-and-filters-tools), or when you create OT sensor reports that include port information.
24+
Port names are shown in Defender for IoT when [viewing device groups from the OT sensor's device map](how-to-work-with-the-sensor-device-map.md), or when you create OT sensor reports that include port information.
2525

2626
**To customize a port name:**
2727

‎articles/defender-for-iot/organizations/how-to-investigate-all-enterprise-sensor-detections-in-a-device-inventory.md

Lines changed: 1 addition & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ Use any of the following options to modify or filter the devices shown:
3333
| **Save a filter** | To save the current set of filters, select the **Save As** button that appears in the filter row.|
3434
| **Load a saved filter** | Saved filters are listed on the left, in the **Groups** pane. <br><br>1. Select the **Options** :::image type="icon" source="media/how-to-work-with-asset-inventory-information/options-menu.png"border="false"::: button in the toolbar to display the **Groups** pane. <br>2. In the **Device Inventory Filters** list, select the saved filter you want to load. |
3535

36-
For more information, see [Device inventory column reference](#device-inventory-column-reference).
36+
For more information, see [Device inventory column data](device-inventory.md#device-inventory-column-data).
3737

3838
## Export the device inventory to CSV
3939

@@ -130,35 +130,6 @@ For example:
130130

131131
For more information, see [Defender for IoT sensor and management console APIs](references-work-with-defender-for-iot-apis.md).
132132

133-
## Device inventory column reference
134-
135-
The following table describes the device properties shown in the **Device inventory** page on an on-premises management console.
136-
137-
| Name | Description |
138-
|--|--|
139-
| **Unacknowledged Alerts** | The number of unhandled alerts associated with this device. |
140-
| **Business Unit** | The business unit that contains this device. |
141-
| **Region** | The region that contains this device. |
142-
| **Site** | The site that contains this device. |
143-
| **Zone** | The zone that contains this device. |
144-
| **Appliance** | The Microsoft Defender for IoT sensor that protects this device. |
145-
| **Name** | The name of this device as Defender for IoT discovered it. |
146-
| **Type** | The type of device, such as PLC or HMI. |
147-
| **Vendor** | The name of the device's vendor, as defined in the MAC address. |
148-
| **Operating System** | The OS of the device. |
149-
| **Firmware** | The device's firmware. |
150-
| **IP Address** | The IP address of the device. |
151-
| **VLAN** | The VLAN of the device. |
152-
| **MAC Address** | The MAC address of the device. |
153-
| **Protocols** | The protocols that the device uses. |
154-
| **Unacknowledged Alerts** | The number of unhandled alerts associated with this device. |
155-
| **Is Authorized** | The authorization status of the device:<br />- **True**: The device has been authorized.<br />- **False**: The device hasn't been authorized. |
156-
| **Is Known as Scanner** | Whether this device performs scanning-like activities in the network. |
157-
| **Is Programming Device** | Whether the device is a programming device:<br />- **True**: The device performs programming activities for PLCs, RTUs, and controllers, which are relevant to engineering stations.<br />- **False**: The device isn't a programming device. |
158-
| **Groups** | Groups in which this device participates. |
159-
| **Last Activity** | The last activity that the device performed. |
160-
| **Discovered** | When this device was first seen in the network. |
161-
| **PLC mode (preview)** | The PLC operating mode includes the Key state (physical) and run state (logical). Possible **Key** states include, Run, Program, Remote, Stop, Invalid, Programming Disabled.Possible Run. The possible **Run** states are Run, Program, Stop, Paused, Exception, Halted, Trapped, Idle, Offline. if both states are the same, only one state is presented. |
162133

163134
## Next steps
164135

0 commit comments

Comments
 (0)