You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/defender-for-iot/organizations/iot-solution.md
+12-16Lines changed: 12 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -32,10 +32,6 @@ Before you start, make sure you have the following requirements on your workspac
32
32
33
33
- A Defender for IoT plan on your Azure subscription with data streaming into Defender for IoT. For more information, see [Quickstart: Get started with Defender for IoT](getting-started.md).
34
34
35
-
> [!IMPORTANT]
36
-
> Currently, having both the Microsoft Defender for IoT and the [Microsoft Defender for Cloud](../../sentinel/data-connectors/microsoft-defender-for-cloud.md) data connectors enabled on the same Microsoft Sentinel workspace simultaneously may result in duplicate alerts in Microsoft Sentinel. We recommend that you disconnect the Microsoft Defender for Cloud data connector before connecting to Microsoft Defender for IoT.
37
-
>
38
-
39
35
## Connect your data from Defender for IoT to Microsoft Sentinel
40
36
41
37
Start by enabling the [Defender for IoT data connector](../../sentinel/data-connectors/microsoft-defender-for-iot.md) to stream all your Defender for IoT events into Microsoft Sentinel.
@@ -63,54 +59,54 @@ After you've connected a subscription to Microsoft Sentinel, you'll be able to v
63
59
**To see all alerts generated by Defender for IoT**:
64
60
65
61
```kusto
66
-
SecurityAlert | where ProductName == "Azure Security Center for IoT"
62
+
SecurityAlert | where ProviderName == "IoTSecurity"
67
63
```
68
64
69
65
**To see specific sensor alerts generated by Defender for IoT**:
70
66
71
67
```kusto
72
68
SecurityAlert
73
-
| where ProductName == "Azure Security Center for IoT"
69
+
| where ProviderName == "IoTSecurity"
74
70
| where tostring(parse_json(ExtendedProperties).SensorId) == “<sensor_name>”
75
71
```
76
72
77
73
**To see specific OT engine alerts generated by Defender for IoT**:
78
74
79
75
```kusto
80
76
SecurityAlert
81
-
| where ProductName == "Azure Security Center for IoT"
77
+
| where ProviderName == "IoTSecurity"
82
78
| where ProductComponentName == "MALWARE"
83
79
84
80
SecurityAlert
85
-
| where ProductName == "Azure Security Center for IoT"
81
+
| where ProviderName == "IoTSecurity"
86
82
| where ProductComponentName == "ANOMALY"
87
83
88
84
SecurityAlert
89
-
| where ProductName == "Azure Security Center for IoT"
85
+
| where ProviderName == "IoTSecurity"
90
86
| where ProductComponentName == "PROTOCOL_VIOLATION"
91
87
92
88
SecurityAlert
93
-
| where ProductName == "Azure Security Center for IoT"
89
+
| where ProviderName == "IoTSecurity"
94
90
| where ProductComponentName == "POLICY_VIOLATION"
95
91
96
92
SecurityAlert
97
-
| where ProductName == "Azure Security Center for IoT"
93
+
| where ProviderName == "IoTSecurity"
98
94
| where ProductComponentName == "OPERATIONAL"
99
95
```
100
96
101
97
**To see high severity alerts generated by Defender for IoT**:
102
98
103
99
```kusto
104
100
SecurityAlert
105
-
| where ProductName == "Azure Security Center for IoT"
101
+
| where ProviderName == "IoTSecurity"
106
102
| where AlertSeverity == "High"
107
103
```
108
104
109
105
**To see specific protocol alerts generated by Defender for IoT**:
110
106
111
107
```kusto
112
108
SecurityAlert
113
-
| where ProductName == "Azure Security Center for IoT"
109
+
| where PProviderName == "IoTSecurity"
114
110
| where tostring(parse_json(ExtendedProperties).Protocol) == "<protocol_name>"
115
111
```
116
112
@@ -138,16 +134,16 @@ For more information, see [View alerts on the Defender for IoT portal](how-to-ma
138
134
139
135
### Understand multiple records per alert
140
136
141
-
Defender for IoT alert data is streamed to the Microsoft Sentinel and stored in your Log Analytics workspace, in the [SecurityAlert]() table.
137
+
Defender for IoT alert data is streamed to the Microsoft Sentinel and stored in your Log Analytics workspace, in the [SecurityAlert](/azure/sentinel/security-alert-schema) table.
142
138
143
139
Records in the **SecurityAlert** table are created each time an alert is generated or updated in Defender for IoT. Sometimes a single alert will have multiple records, such as when the alert was first created and then again when it was updated.
144
140
145
141
In Microsoft Sentinel, use the following query to check the records added to the **SecurityAlert** table for a single alert:
146
142
147
143
```kql
148
144
SecurityAlert
149
-
| where ProductName == "Azure Security Center for IoT"
150
-
| where VendorOriginalId == "Defender for IoT Alert ID"
145
+
| where ProviderName == "IoTSecurity"
146
+
| where VendorOriginalId == "<Defender for IoT Alert ID>"
Copy file name to clipboardExpand all lines: articles/defender-for-iot/organizations/manage-users-portal.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,7 @@ ms.collection:
11
11
12
12
Microsoft Defender for IoT provides tools both in the Azure portal and on-premises for managing user access across Defender for IoT resources.
13
13
14
-
In the Azure portal, user management is managed at the *subscription* level with [Microsoft Entra ID](../../active-directory/index.yml) and [Azure role-based access control (RBAC)](../../role-based-access-control/overview.md). Assign Microsoft Entra users with Azure roles at the subscription level so that they can add or update Defender for IoT pricing plans and access device data, manage sensors, and access device data across Defender for IoT.
14
+
In the Azure portal, user management is managed at the *subscription* level with [Microsoft Entra ID](../../active-directory/index.yml) and [Azure role-based access control (RBAC)](../../role-based-access-control/overview.md). Assign Microsoft Entra users with Azure roles at the subscription level so that they can add or update Defender for IoT pricing plans, access device data, and manage sensors.
15
15
16
16
For OT network monitoring, Defender for IoT has the extra *site* level, which you can use to add granularity to your user management. For example, assign roles at the site level to apply different permissions for the same users across different sites.
0 commit comments