Skip to content

Commit 8b64a47

Browse files
authored
Merge branch 'sensor-version-22.3.8-release' into patch-328
2 parents 735849f + a83259c commit 8b64a47

File tree

4 files changed

+15
-22
lines changed

4 files changed

+15
-22
lines changed

articles/defender-for-iot/organizations/concept-supported-protocols.md

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,21 +24,22 @@ OT network sensors can detect the following protocols when identifying assets an
2424
|**Emerson** | DeltaV<br> DeltaV - Discovery<br> Emerson OpenBSI/BSAP<br> Ovation DCS ADMD<br>Ovation DCS DPUSTAT<br> Ovation DCS SSRPC |
2525
|**Emerson Fischer** | ROC |
2626
|**Eurocontrol** | ASTERIX |
27-
|**GE** | Bentley Nevada (System 1 / BN3500)<br> EGD<br> GSM (GE MarkVI and MarkVIe)<br> SRTP (GE)<br> GE_CMP |
27+
|**GE** | Bentley Nevada (System 1 / BN3500)<br>ClassicSDI (MarkVle) <br> EGD<br> GSM (GE MarkVI and MarkVIe)<br>SDI (MarkVle) <br> SRTP (GE)<br> GE_CMP |
2828
|**Generic Applications** | Active Directory<br> RDP<br> Teamviewer<br> VNC<br> |
2929
|**Honeywell** | ENAP<br> Experion DCS CDA<br> Experion DCS FDA<br> Honeywell EUCN <br> Honeywell Discovery |
3030
|**IEC** | Codesys V3<br>IEC 60870-5-7 (IEC 62351-3 + IEC 62351-5)<br> IEC 60870-5-101 (encapsulated serial)<br> IEC 60870-5-103 (encapsulated serial)<br> IEC 60870-5-104<br> IEC 60870-5-104 ASDU_APCI<br> IEC 60870 ICCP TASE.2<br> IEC 61850 GOOSE<br> IEC 61850 MMS<br> IEC 61850 SMV (SAMPLED-VALUES)<br> LonTalk (LonWorks) |
3131
|**IEEE** | LLC<br> STP<br> VLAN |
3232
|**IETF** | ARP<br> DHCP<br> DCE RPC<br> DNS<br> FTP (FTP_ADAT<br> FTP_DATA)<br> GSSAPI (RFC2743)<br> HTTP<br> ICMP<br> IPv4<br> IPv6<br> LLDP<br> MDNS<br> NBNS<br> NTLM (NTLMSSP Auth Protocol)<br> RPC<br> SMB / Browse / NBDGM<br> SMB / CIFS<br> SNMP<br> SPNEGO (RFC4178)<br> SSH<br> Syslog<br> TCP<br> Telnet<br> TFTP<br> TPKT<br> UDP |
33-
| **InterSite** | add items here |
33+
| **InterSite** | <!--tbd--> |
3434
|**ISO** | CLNP (ISO 8473)<br> COTP (ISO 8073)<br> ISO Industrial Protocol<br> MQTT (IEC 20922) |
3535
|**Medical** |ASTM<br> HL7 |
3636
|**Microsoft** | Horizon community dissectors<br> Horizon proprietary dissectors (developed by customers) |
3737
|**Mitsubishi** | Melsoft / Melsec (Mitsubishi Electric) |
3838
|**Omron** | FINS |
3939
|**OPC** | UA |
4040
|**Oracle** | TDS<br> TNS |
41-
|**Rockwell Automation** | ENIP<br> EtherNet/IP CIP (including Rockwell extension)<br> EtherNet/IP CIP FW version 27 and above |
41+
| **Profitnet I/O** | <!--TBD--> |
42+
|**Rockwell Automation** | CSP2<br> ENIP<br> EtherNet/IP CIP (including Rockwell extension)<br> EtherNet/IP CIP FW version 27 and above |
4243
|**Samsung** | Samsung TV |
4344
|**Schneider Electric** | Modbus/TCP<br> Modbus TCP–Schneider Unity Extensions<br> OASYS (Schneider Electric Telvant)<br> Schneider TSAA |
4445
|**Schneider Electric / Invensys** | Foxboro Evo<br> Foxboro I/A<br> Trident<br> TriGP<br> TriStation |

articles/defender-for-iot/organizations/detect-windows-endpoints-script.md

Lines changed: 8 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -43,26 +43,18 @@ The script described in this article is supported for the following Windows oper
4343
- Windows 10
4444
- Windows Server 2003/2008/2012/2016/2019
4545

46-
## Download the script
46+
## Download and run the script
4747

48-
In order to run the script, you first need to download it from the OT sensor console.
48+
This procedure describes how to deploy and run a script on the Windows workstation and servers that you want to monitor in Defender for IoT.
49+
50+
The script detects enriched Windows data, and is run as a utility and not an installed program. Running the script doesn't affect the endpoint. You may want to deploy the script once, or using ongoing automation, using standard automated deployment methods and tools.
4951

5052
1. Sign into your OT sensor console, and select **System Settings** > **Import Settings** > **Windows Information**.
5153

52-
1. Select **Download script**.
54+
1. Select **Download script**. For example:
5355

5456
:::image type="content" source="media/detect-windows-endpoints-script/download-wmi-script.png" alt-text="Screenshot of where to download WMI script." lightbox="media/detect-windows-endpoints-script/download-wmi-script.png":::
5557

56-
## Run the script
57-
58-
This procedure describes how to deploy and run the script on the Windows workstation and servers that you want to monitor in Defender for IoT.
59-
60-
The script you run to detect enriched Windows data is run as a utility and not as an installed program. Running the script doesn't affect the endpoint.
61-
62-
1. Deploy the script once, or using ongoing automation, using standard automated deployment methods and tools.
63-
64-
1. Download the WMI script as described [earlier](#download-the-script).
65-
6658
1. Copy the script to a local drive and unzip it. The following files appear:
6759

6860
- `start.bat`
@@ -74,15 +66,15 @@ The script you run to detect enriched Windows data is run as a utility and not a
7466

7567
After the script runs to probe the registry, a CX-snapshot file appears with the registry information. The filename indicates the system name, date, and time of the snapshot with the following syntax: `CX-snaphot_SystemName_Month_Year_Time`
7668

77-
Files generated by the script:
69+
Files generated by the script include:
7870

7971
- Remain on the local drive until you delete them.
8072
- Must remain in the same location. Don't separate the generated files.
8173
- Are overwritten if you run the script again.
8274

8375
## Import device details
8476

85-
After having run the script as described [earlier](#run-the-script), import the generated data to your sensor to view the device details in the **Device inventory**.
77+
After having run the script as described [earlier](#download-and-run-the-script), import the generated data to your sensor to view the device details in the **Device inventory**.
8678

8779
**To import device details to your sensor**:
8880

@@ -104,7 +96,7 @@ After having run the script as described [earlier](#run-the-script), import the
10496

10597
To preform offline WMI:
10698

107-
1. [Download the script](#download-the-script), then extract it.
99+
1. [Download the script](#download-and-run-the-script), then extract it.
108100

109101
1. Run `run.bat` as administrator directly on the Windows endpoint.
110102

articles/defender-for-iot/organizations/release-notes.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ To understand whether a feature is supported in your sensor version, check the r
101101

102102
**Supported until**: 03/2024
103103

104-
- [Download WMI script from OT sensor console](detect-windows-endpoints-script.md#download-the-script)
104+
- [Download WMI script from OT sensor console](detect-windows-endpoints-script.md#download-and-run-the-script)
105105
- [Automatically resolved notifications for operating system changes and device type changes](how-to-work-with-the-sensor-device-map.md#device-notification-responses)
106106
- [UI enhancements when uploading SSL/TLS certificates](how-to-deploy-certificates.md#deploy-a-certificate-on-an-ot-sensor)
107107

articles/defender-for-iot/organizations/whats-new.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,9 @@ Features released earlier than nine months ago are described in the [What's new
2626

2727
The script used to configure OT sensors to detect Microsoft Windows workstations and servers is now available for download from the OT sensor itself.
2828

29-
For more information, see [Download the script](detect-windows-endpoints-script.md#download-the-script).
29+
For more information, see [Download the script](detect-windows-endpoints-script.md#download-and-run-the-script)
3030

31-
### Automatically resolved notifications for operating system changes
31+
### Automatically resolved OS notifications
3232

3333
After updating your OT sensor to version 22.3.8, no new device notifications for **Operating system changes** are generated. Existing **Operating system changes** notifications are automatically resolved if they aren't dismissed or otherwise handled within 14 days.
3434

0 commit comments

Comments
 (0)