You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/defender-for-iot/organizations/release-notes-archive.md
+87-1Lines changed: 87 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
title: What's new archive for Microsoft Defender for IoT for organizations
3
3
description: Learn about the features and enhancements released for Microsoft Defender for IoT for organizations more than 6 months ago.
4
4
ms.topic: overview
5
-
ms.date: 03/03/2022
5
+
ms.date: 08/07/2022
6
6
---
7
7
8
8
# What's new archive for in Microsoft Defender for IoT for organizations
@@ -15,6 +15,92 @@ For more recent updates, see [What's new in Microsoft Defender for IoT?](release
15
15
16
16
Noted features listed below are in PREVIEW. The [Azure Preview Supplemental Terms](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) include other legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
17
17
18
+
19
+
## November 2021
20
+
21
+
**Sensor software version**: 10.5.3
22
+
23
+
The following feature enhancements are available with version 10.5.3 of Microsoft Defender for IoT.
24
+
25
+
- The on-premises management console, has a new [ServiceNow Integration API - “/external/v3/integration/ (Preview)](references-work-with-defender-for-iot-apis.md#servicenow-integration-api---externalv3integration-preview).
26
+
27
+
- Enhancements have been made to the network traffic analysis of multiple OT and ICS protocol dissectors.
28
+
29
+
- As part of our automated maintenance, archived alerts that are over 90 days old will now be automatically deleted.
30
+
31
+
- Many enhancements have been made to the exporting of alert metadata based on customer feedback.
32
+
33
+
## October 2021
34
+
35
+
**Sensor software version**: 10.5.2
36
+
37
+
The following feature enhancements are available with version 10.5.2 of Microsoft Defender for IoT.
Users can now view PLC operating mode states, changes, and risks. The PLC Operating mode consists of the PLC logical Run state and the physical Key state, if a physical key switch exists on the PLC.
52
+
53
+
This new capability helps improve security by detecting *unsecure* PLCs, and as a result prevents malicious attacks such as PLC Program Downloads. The 2017 Triton attack on a petrochemical plant illustrates the effects of such risks.
54
+
This information also provides operational engineers with critical visibility into the operational mode of enterprise PLCs.
55
+
56
+
#### What is an unsecure mode?
57
+
58
+
If the Key state is detected as Program or the Run state is detected as either Remote or Program the PLC is defined by Defender for IoT as *unsecure*.
59
+
60
+
#### Visibility and risk assessment
61
+
62
+
- Use the Device Inventory to view the PLC state of organizational PLCs, and contextual device information. Use the Device Inventory Settings dialog box to add this column to the Inventory.
- View PLC secure status and last change information per PLC in the Attributes section of the Device Properties screen. If the Key state is detected as Program or the Run state is detected as either Remote or Program the PLC is defined by Defender for IoT as *unsecure*. The Device Properties PLC Secured option will read false.
- Use the Risk Assessment Report to review the number of network PLCs in the unsecure mode, and additional information you can use to mitigate unsecure PLC risks.
75
+
76
+
### PCAP API
77
+
78
+
The new PCAP API lets the user retrieve PCAP files from the sensor via the on-premises management console with, or without direct access to the sensor itself.
79
+
80
+
### On-premises Management Console audit
81
+
82
+
Audit logs for the on-premises management console can now be exported to facilitate investigations into what changes were made, and by who.
83
+
84
+
### Webhook extended
85
+
86
+
Webhook extended can be used to send extra data to the endpoint. The extended feature includes all of the information in the Webhook alert and adds the following information to the report:
87
+
88
+
- sensorID
89
+
- sensorName
90
+
- zoneID
91
+
- zoneName
92
+
- siteID
93
+
- siteName
94
+
- sourceDeviceAddress
95
+
- destinationDeviceAddress
96
+
- remediationSteps
97
+
- handled
98
+
- additionalInformation
99
+
100
+
### Unicode support for certificate passphrases
101
+
102
+
Unicode characters are now supported when working with sensor certificate passphrases. For more information, see [About certificates](how-to-deploy-certificates.md#about-certificates)
103
+
18
104
## April 2021
19
105
20
106
### Work with automatic threat Intelligence updates (Public Preview)
Copy file name to clipboardExpand all lines: articles/defender-for-iot/organizations/release-notes.md
+1-86Lines changed: 1 addition & 86 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
title: What's new in Microsoft Defender for IoT
3
3
description: This article lets you know what's new in the latest release of Defender for IoT.
4
4
ms.topic: overview
5
-
ms.date: 07/21/2022
5
+
ms.date: 08/07/2022
6
6
---
7
7
8
8
# What's new in Microsoft Defender for IoT?
@@ -606,91 +606,6 @@ This new functionality is available on the following alerts:
606
606
- Malware alerts, based on activity of the source device. (generated by the Malware engine).
607
607
- Suspicion of Denial of Service Attack alerts, based on activity of the destination device (generated by the Malware engine)
608
608
609
-
## November 2021
610
-
611
-
**Sensor software version**: 10.5.3
612
-
613
-
The following feature enhancements are available with version 10.5.3 of Microsoft Defender for IoT.
614
-
615
-
- The on-premises management console, has a new [ServiceNow Integration API - “/external/v3/integration/ (Preview)](references-work-with-defender-for-iot-apis.md#servicenow-integration-api---externalv3integration-preview).
616
-
617
-
- Enhancements have been made to the network traffic analysis of multiple OT and ICS protocol dissectors.
618
-
619
-
- As part of our automated maintenance, archived alerts that are over 90 days old will now be automatically deleted.
620
-
621
-
- Many enhancements have been made to the exporting of alert metadata based on customer feedback.
622
-
623
-
## October 2021
624
-
625
-
**Sensor software version**: 10.5.2
626
-
627
-
The following feature enhancements are available with version 10.5.2 of Microsoft Defender for IoT.
Users can now view PLC operating mode states, changes, and risks. The PLC Operating mode consists of the PLC logical Run state and the physical Key state, if a physical key switch exists on the PLC.
642
-
643
-
This new capability helps improve security by detecting *unsecure* PLCs, and as a result prevents malicious attacks such as PLC Program Downloads. The 2017 Triton attack on a petrochemical plant illustrates the effects of such risks.
644
-
This information also provides operational engineers with critical visibility into the operational mode of enterprise PLCs.
645
-
646
-
#### What is an unsecure mode?
647
-
648
-
If the Key state is detected as Program or the Run state is detected as either Remote or Program the PLC is defined by Defender for IoT as *unsecure*.
649
-
650
-
#### Visibility and risk assessment
651
-
652
-
- Use the Device Inventory to view the PLC state of organizational PLCs, and contextual device information. Use the Device Inventory Settings dialog box to add this column to the Inventory.
- View PLC secure status and last change information per PLC in the Attributes section of the Device Properties screen. If the Key state is detected as Program or the Run state is detected as either Remote or Program the PLC is defined by Defender for IoT as *unsecure*. The Device Properties PLC Secured option will read false.
- Use the Risk Assessment Report to review the number of network PLCs in the unsecure mode, and additional information you can use to mitigate unsecure PLC risks.
665
-
666
-
### PCAP API
667
-
668
-
The new PCAP API lets the user retrieve PCAP files from the sensor via the on-premises management console with, or without direct access to the sensor itself.
669
-
670
-
### On-premises Management Console audit
671
-
672
-
Audit logs for the on-premises management console can now be exported to facilitate investigations into what changes were made, and by who.
673
-
674
-
### Webhook extended
675
-
676
-
Webhook extended can be used to send extra data to the endpoint. The extended feature includes all of the information in the Webhook alert and adds the following information to the report:
677
-
678
-
- sensorID
679
-
- sensorName
680
-
- zoneID
681
-
- zoneName
682
-
- siteID
683
-
- siteName
684
-
- sourceDeviceAddress
685
-
- destinationDeviceAddress
686
-
- remediationSteps
687
-
- handled
688
-
- additionalInformation
689
-
690
-
### Unicode support for certificate passphrases
691
-
692
-
Unicode characters are now supported when working with sensor certificate passphrases. For more information, see [About certificates](how-to-deploy-certificates.md#about-certificates)
693
-
694
609
## Next steps
695
610
696
611
[Getting started with Defender for IoT](getting-started.md)
0 commit comments