Skip to content

Commit 90e2ada

Browse files
liljack17liljack17
authored
Merge pull request #222129 from miashapan/dmi-decoder
DMI decoder + provision fixes + TOC
2 parents 6514388 + b295e13 commit 90e2ada

File tree

3 files changed

+127
-0
lines changed

3 files changed

+127
-0
lines changed

‎articles/defender-for-iot/device-builders/TOC.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,12 +70,16 @@
7070
- name: Configure Microsoft Defender for IoT agent-based solution
7171
displayName: data, collection, geolocation, log analytics, raw events
7272
href: how-to-configure-agent-based-solution.md
73+
- name: How to configure the DMI Decoder
74+
href: how-to-configure-dmi-decoder.md
7375
- name: Investigate CIS benchmark recommendation
7476
href: how-to-investigate-cis-benchmark.md
7577
- name: Configure a micro agent twin
7678
href: how-to-configure-micro-agent-twin.md
7779
- name: Configure PAM to audit sign-in events
7880
href: configure-pam-to-audit-sign-in-events.md
81+
- name: Provision micro agent using DPS
82+
href: how-to-provision-micro-agent.md
7983
- name: Create custom alerts
8084
displayName: security group
8185
href: quickstart-create-custom-alerts.md

‎articles/defender-for-iot/device-builders/how-to-configure-dmi-decoder.md

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
---
2+
title: How to configure the DMI Decoder
3+
description: Learn how to configure your DMI decoder on your device, or use other alternatives.
4+
ms.date: 12/22/2022
5+
ms.topic: how-to
6+
---
7+
8+
# DMI Decoder configurations
9+
10+
This article explains how to configure the DMI decoder, and alternative configurations for devices that do not support it.
11+
12+
## Overview
13+
14+
The Microsoft Defender for IoT **Device inventory** provides an overview of all IoT devices in your environment. The device inventory table can be customized to your preferences by adding or removing information fields, and filtering the fields.
15+
16+
The DMI decoder is used to retrieve data on the hardware and firmware of the device.
17+
18+
Retrieved fields are:
19+
20+
- Firmware vendor
21+
- Firmware version
22+
- Hardware model
23+
- Hardware serial number
24+
- Hardware vendor
25+
26+
For more information on the DMI Decoder, see [dmidecode(8): DMI table decoder - Linux man page (die.net)](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flinux.die.net%2Fman%2F8%2Fdmidecode&data=05%7C01%7Cmiashapan%40microsoft.com%7C07f0384fdcf14dd8cdb808dae0be41a4%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638069405000113003%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=%2FSFH0ALDDf6OPMsXW99gEP%2Bvu%2F1eIXyunIQth682NbQ%3D&reserved=0).
27+
28+
## Populate SMBIOS tables for dmidecode
29+
30+
To support dmidecode(8), SMBIOS tables needs to be present and valid.
31+
To implement, please refer to the [System Management BIOS specifications](https://lwn.net/Articles/451967/).
32+
33+
## Alternative configurations
34+
35+
For devices that do not support the DMI decoder, there are two alternative options for retrieving and setting the firmware and hardware fields.
36+
37+
### JSON file
38+
39+
To manually set the values on the device, create a JSON file. The micro agent will read the values from the JSON file and send them to the cloud.
40+
41+
To configure the file, use the following path and format details:
42+
43+
- Path:
44+
45+
```bash
46+
/etc/defender_iot_micro_agent/sysinfo.json
47+
```
48+
49+
- Format:
50+
51+
```bash
52+
"HardwareVendor": "<hardware vendor>",
53+
"HardwareModel": "<hardware model>",
54+
"HardwareSerialNumber": "<hardware serial number>",
55+
"FirmwareVendor": "<firmware vendor>",
56+
"FirmwareVersion": "<firmware version>"
57+
```
58+
59+
### Module twin configurations
60+
61+
To manually set the values on the cloud, use the module twin configuration by setting the following properties:
62+
63+
```bash
64+
“properties”:{
65+
“desired”:{
66+
“SystemInformation_HardwareVendor”: ”<data>”,
67+
“SystemInformation_HardwareModel”: ”<data>”,
68+
“SystemInformation_FirmwareVendor”: ”<data>”,
69+
“SystemInformation_ FirmwareVersion”: ”<data>”,
70+
“SystemInformation_HardwareSerialNumber”: ”<data>”
71+
}
72+
}
73+
```
74+
75+
## Next steps
76+
77+
> [Configure Microsoft Defender for IoT agent-based solution](tutorial-configure-agent-based-solution.md)
78+
79+
> [Configure pluggable Authentication Modules (PAM) to audit sign-in events (Preview)](configure-pam-to-audit-sign-in-events.md)

‎articles/defender-for-iot/device-builders/how-to-provision-micro-agent.md

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
title: Provision the Microsoft Defender for IoT micro agent using DPS
3+
description: Learn how to provision the Microsoft Defender for IoT micro agent using DPS.
4+
ms.date: 12/22/2022
5+
ms.topic: how-to
6+
---
7+
8+
# Provision the Microsoft Defender for IoT micro agent using DPS
9+
10+
This article explains how to provision the standalone Microsoft Defender for IoT micro agent using [Azure IoT Hub Device Provisioning Service](../../iot-dps/about-iot-dps.md) with [X.509 certificate attestation](../../iot-dps/concepts-x509-attestation.md).
11+
12+
To learn how to configure the Microsoft Defender for IoT micro agent for Edge devices see [Create and provision IoT Edge devices at scale]../../iot-edge/how-to-provision-devices-at-scale-linux-tpm.md).
13+
14+
## Prerequisites
15+
16+
- An Azure account with an active subscription. [Create an account for free]https://azure.microsoft).
17+
18+
- An [IoT hub](../../iot-hub/iot-hub-create-through-portal.md).
19+
20+
- [IoT Hub Device Provisioning Service](../../iot-dps/quick-setup-auto-provision.md).
21+
22+
## Provision
23+
24+
1. In the [Azure portal](https://portal.azure.com), go to your instance of the IoT Hub device provisioning service.
25+
26+
1. Under Settings, select Manage enrollments.
27+
1. Select Add individual enrollment, and then complete the steps to configure the enrollment:
28+
1. Choose X.509 at the identity attestation Mechanism and choose your CA.
29+
1. Navigate into your destination IoT Hub.
30+
1. Create a new module issued by the same certificate.
31+
1. Configure the micro agent to use the created module (Note that the device does not have to exist yet).
32+
1. Navigate back to DPS and provision the device through DPS.
33+
1. Navigate to the configured device in the destination IoT Hub.
34+
1. Create a new module for the device issued by the same CA authenticator.
35+
1. Run the agent that you configured in step 4 to see it connects to the device.
36+
37+
> [!NOTE]
38+
> Using this procedure, while you don't need the device to exists before configuring the agent, you do need to know the device name in advance in order to issue the certificate for the final module correctly.
39+
40+
## Next steps
41+
42+
> [Configure Microsoft Defender for IoT agent-based solution](tutorial-configure-agent-based-solution.md)
43+
44+
> [Configure pluggable Authentication Modules (PAM) to audit sign-in events (Preview)](configure-pam-to-audit-sign-in-events.md)

0 commit comments

Comments
 (0)