|
1 | 1 | --- |
2 | 2 | title: Protocols supported by Microsoft Defender for IoT |
3 | 3 | description: Learn about protocols that are supported by Microsoft Defender for IoT. |
4 | | -ms.date: 11/09/2021 |
| 4 | +ms.date: 03/16/2022 |
5 | 5 | ms.topic: article |
6 | 6 | --- |
7 | 7 |
|
8 | | -# Support for IoT, OT, ICS, and SCADA protocols |
| 8 | +# Microsoft Defender for IoT - supported IoT, OT, ICS, and SCADA protocols |
9 | 9 |
|
10 | | -Microsoft Defender for IoT provides an open and interoperable Operation Technology (OT) cybersecurity platform. Defender for IoT reduces IoT, IT, and ICS risk with deployments in demanding and complex OT environments across all industry verticals and geographies. |
| 10 | +This article lists the protocols that are supported by default in Microsoft Defender for IoT. If your organization uses proprietary protocols or other protocols not listed here, use the Defender for IoT Horizon SDK to extend support as needed. |
11 | 11 |
|
12 | | -## Supported protocols |
| 12 | +## Supported protocols for asset discovery |
13 | 13 |
|
14 | | -Defender for IoT supports a broad range of protocols across a diverse enterprise. Supported protocols include industrial automation equipment across all industrial sectors, enterprise networks, and building management system (BMS) environments. |
| 14 | +Defender for IoT can detect the following protocols when identifying assets and devices in your network: |
15 | 15 |
|
16 | | -For custom or proprietary protocols, Microsoft offers an SDK that makes it easy to develop, test, and deploy custom protocol dissectors as plugins. The SDK does all this without divulging proprietary information, such as how the protocols are designed, or by sharing PCAPs that may contain sensitive information. Supported protocols are listed below. |
17 | 16 |
|
18 | | -### Supported protocols (passive monitoring) |
| 17 | +|Brand |Protocols | |
| 18 | +|---------|---------| |
| 19 | +|**ABB** | IEC61850 MMS (including ABB extension) | |
| 20 | +|**ASHRAE** | BACnet<br> BACnet BACapp<br> BACnet BVLC | |
| 21 | +|**Beckhoff** | AMS (ADS)<br> Twincat | |
| 22 | +|**Cisco** | CAPWAP Control<br> CAPWAP Data<br> CDP<br> LWAPP | |
| 23 | +|**DNP. org** | DNP3 | |
| 24 | +|**Emerson** | DeltaV<br> Emerson OpenBSI/BSAP<br> Ovation DCS ADMD<br>Ovation DCS DPUSTAT<br> Ovation DCS SSRPC | |
| 25 | +|**Emerson Fischer** | ROC | |
| 26 | +|**Eurocontrol** | ASTERIX | |
| 27 | +|**GE** | Bentley Nevada (System 1)<br> EGD<br> GSM (GE MarkVI and MarkVIe)<br> SRTP (GE) | |
| 28 | +|**Honeywell** | ENAP<br> Experion DCS CDA<br> Experion DCS FDA | |
| 29 | +|**IEC** | Codesys V3<br> ICCP TASE.2/IEC-60870<br> IEC60870-5 (IEC104/101)<br> IEC60870-5-103 (encapsulated serial)<br> IEC61850 GOOSE<br> IEC61850 MMS<br> IEC61850 SMV (SAMPLED-VALUES)<br> LonTalk (LonWorks) | |
| 30 | +|**IEEE** | LLC<br> STP<br> VLAN | |
| 31 | +|**IETF** | ARP<br> DCE RPC<br> DNS<br> FTP (FTP_ADAT<br> FTP_DATA)<br> GSSAPI (RFC2743)<br> HTTP<br> ICMP<br> IPv4<br> IPv6<br> LLDP<br> MDNS<br> NBNS<br> NTLM (NTLMSSP Auth Protocol)<br> RPC<br> SMB / Browse / NBDGM<br> SMB / CIFS<br> SNMP<br> SPNEGO (RFC4178)<br> SSH<br> Syslog<br> Telnet<br> TFTP<br> TPKT<br> UDP | |
| 32 | +|**ISO** | CLNP (ISO 8473)<br> COTP (ISO 8073)<br> ISO Industrial Protocol<br> MQTT (IEC 20922) | |
| 33 | +|**Medical** |ASTM<br> HL7 | |
| 34 | +|**Microsoft** | Horizon community dissectors<br> Horizon proprietary dissectors (developed by customers) | |
| 35 | +|**Mitsubishi** | Melsoft / Melsec (Mitsubishi Electric) | |
| 36 | +|**Omron** | FINS | |
| 37 | +|**Oracle** | TDS<br> TNS | |
| 38 | +|**Rockwell Automation** | ENIP<br> EtherNet/IP CIP (including Rockwell extension)<br> EtherNet/IP CIP FW version 27 and above | |
| 39 | +|**Schneider Electric** | Modbus/TCP<br> Modbus TCP–Schneider Unity Extensions<br> OASYS (Schneider Electric Telvant) | |
| 40 | +|**Schneider Electric / Invensys** | Foxboro Evo<br> Foxboro I/A<br> Trident<br> TriGP<br> TriStation | |
| 41 | +|**Schneider Electric / Modicon** | Modbus RTU | |
| 42 | +|**Schneider Electric / Wonderware** | Wonderware Suitelink | |
| 43 | +|**Siemens** | CAMP<br> PCS7<br> PCS7 WinCC – Historian<br> Profinet DCP<br> Profinet Realtime<br> Siemens PHD<br> Siemens S7<br> Siemens S7-Plus<br> Siemens S7-Plus<br> Siemens SICAM<br> Siemens WinCC | |
| 44 | +|**Toshiba** |Toshiba Computer Link | |
| 45 | +|**Yokogawa** | Centum ODEQ (Centum / ProSafe DCS)<br> HIS Equalize<br> Vnet/IP | |
19 | 46 |
|
20 | | -This section lists protocols that are detected using passive monitoring. |
21 | 47 |
|
22 | | -**ABB:** IEC61850 MMS (including ABB extension) |
| 48 | +## Supported protocols for active monitoring |
23 | 49 |
|
24 | | -**ASHRAE:** BACnet, BACnet BACapp, BACnet BVLC |
| 50 | +Defender for IoT can detect the following protocols using active monitoring, such as ping sweeps and queries: |
25 | 51 |
|
26 | | -**Beckhoff:** AMS (ADS), Twincat |
27 | 52 |
|
28 | | -**Cisco:** CAPWAP Control, CAPWAP Data, CDP, LWAPP |
| 53 | +|Brand |Protocols | |
| 54 | +|---------|---------| |
| 55 | +|**IETF** | Ping Sweep <br>SNMP Network Layout Query<br>SNMP Query | |
| 56 | +|**Microsoft** | Windows WMI Query (req. WMI/WinRM): hardware, BIOS, version, software, patches | |
| 57 | +|**Rockwell Automation** | ENIP Query<br> ENIP Scan<br> EtherNet/IP CIP (CIP Query) | |
| 58 | +|**Siemens** | Siemens S7 | |
29 | 59 |
|
30 | | -**DNP. org :** DNP3 |
31 | 60 |
|
32 | | -**Emerson:** DeltaV, Emerson OpenBSI/BSAP, Ovation DCS ADMD,Ovation DCS DPUSTAT, Ovation DCS SSRPC |
33 | 61 |
|
34 | | -**Emerson Fischer:** ROC |
| 62 | +## Don't see your protocol here? |
35 | 63 |
|
36 | | -**Eurocontrol:** ASTERIX |
| 64 | +### Build support for proprietary protocols with the Horizon SDK |
37 | 65 |
|
38 | | -**GE:** Bentley Nevada (System 1), EGD, GSM (GE MarkVI and MarkVIe), SRTP (GE) |
| 66 | +Asset vendors, partners, or platform owners can use Defender for IoT's Horizon Protocol SDK to secure any protocol used in IoT and ICS environments that's not isn't already supported by default. |
39 | 67 |
|
40 | | -**Honeywell:** ENAP, Experion DCS CDA, Experion DCS FDA |
| 68 | +Horizon helps you to write plugins that enable Deep Packet Inspection (DPI) on the traffic and detect threats in realtime. Customize your plugins localize and customize text for alerts, events, and protocol parameters. |
41 | 69 |
|
42 | | -**IEC:** Codesys V3, ICCP TASE.2/IEC-60870, IEC60870-5 (IEC104/101), IEC60870-5-103 (encapsulated serial), IEC61850 GOOSE, IEC61850 MMS, IEC61850 SMV (SAMPLED-VALUES), LonTalk (LonWorks) |
| 70 | +Horizon provides: |
43 | 71 |
|
44 | | -**IEEE**: LLC, STP, VLAN |
| 72 | +- Support for common, proprietary, or custom protocols that deviate from standards |
| 73 | +- Extra flexibility and scope for DPI development |
| 74 | +- Extra visibility and control over your OT assets without needing to update your Defender for IoT version |
| 75 | +- The security of allowing proprietary development without divulging sensitive information |
45 | 76 |
|
46 | | -**IETF:** ARP, DCE RPC, DNS, FTP (FTP_ADAT, FTP_DATA), GSSAPI (RFC2743), HTTP, ICMP, IPv4, IPv6, LLDP, MDNS, NBNS, NTLM (NTLMSSP Auth Protocol), RPC, SMB / Browse / NBDGM, SMB / CIFS, SNMP, SPNEGO (RFC4178), SSH, Syslog, Telnet, TFTP, TPKT, UDP |
| 77 | +:::image type="content" source="media/concept-supported-protocols/sdk-horizon.png" alt-text="Infographic that describes features provided by the Horizon SDK." border="false"::: |
47 | 78 |
|
48 | | -**ISO:** CLNP (ISO 8473), COTP (ISO 8073), ISO Industrial Protocol, MQTT (IEC 20922) |
| 79 | +### Collaborate with the Horizon community |
49 | 80 |
|
50 | | -**Medical:** ASTM, HL7 |
| 81 | +Join our community to help lead the way towards digital transformation and industry-wide collaboration for protocol support! |
51 | 82 |
|
52 | | -**Microsoft:** Horizon community dissectors, Horizon proprietary dissectors (developed by customers). |
| 83 | +The Horizon ICS community shares knowledge between domain experts in critical infrastructures, building management, production lines, transportation systems, and leading industries. For example, our community shares tutorials, discussion forums, instructor-led training, educational white papers, and more. |
53 | 84 |
|
54 | | -**Mitsubishi:** Melsoft / Melsec (Mitsubishi Electric) |
55 | | - |
56 | | -**Omron:** FINS |
57 | | - |
58 | | -**Oracle:** TDS, TNS |
59 | | - |
60 | | -**Rockwell Automation:** ENIP, EtherNet/IP CIP (including Rockwell extension), EtherNet/IP CIP FW version 27 and above |
61 | | - |
62 | | -**Schneider Electric:** Modbus/TCP, Modbus TCP–Schneider Unity Extensions, OASYS (Schneider Electric Telvant) |
63 | | - |
64 | | -**Schneider Electric / Invensys:** Foxboro Evo, Foxboro I/A, Trident, TriGP, TriStation |
65 | | - |
66 | | -**Schneider Electric / Modicon:** Modbus RTU |
67 | | - |
68 | | -**Schneider Electric / Wonderware:** Wonderware Suitelink |
69 | | - |
70 | | -**Siemens:** CAMP, PCS7, PCS7 WinCC – Historian, Profinet DCP, Profinet Realtime, Siemens PHD, Siemens S7, Siemens S7-Plus, Siemens S7-Plus, Siemens SICAM, Siemens WinCC |
71 | | - |
72 | | -**Toshiba:** Toshiba Computer Link |
73 | | - |
74 | | -**Yokogawa:** Centum ODEQ (Centum / ProSafe DCS), HIS Equalize, Vnet/IP |
75 | | - |
76 | | -### Supported protocols (active monitoring) |
77 | | - |
78 | | -This section lists protocols that are detected using active probing, for example ping sweeps and queries. |
79 | | - |
80 | | -**IETF:** Ping Sweep, SNMP Network Layout Query, SNMP Query |
81 | | - |
82 | | -**Microsoft:** Windows WMI Query (req. WMI/WinRM): hardware, BIOS, version, software, patches |
83 | | - |
84 | | -**Rockwell Automation:** ENIP Query, ENIP Scan, EtherNet/IP CIP (CIP Query) |
85 | | - |
86 | | -**Siemens:** Siemens S7 |
87 | | - |
88 | | -## Quickly add support for proprietary, restricted protocols |
89 | | - |
90 | | -Digitization is driving deployment of billions of IoT devices followed by a significant increase in connectivity between IT and OT networks. This means attack surfaces are growing, including a greater risk of dangerous cyber attacks on industrial control systems. |
91 | | - |
92 | | -To help reduce the attack surface, the Horizon Protocol SDK allows quick, secure support of any protocol used in IoT and ICS environments. |
93 | | - |
94 | | -Horizon provides the following solutions for customers and technology partners: |
95 | | - |
96 | | -- Unlimited, full support for common, proprietary, custom protocols or protocols that deviate from any standard. |
97 | | - |
98 | | -- A new level of flexibility and scope for DPI development. |
99 | | - |
100 | | -- A tool that exponentially expands OT visibility and control, without the need to upgrade Defender for IoT platform versions. |
101 | | - |
102 | | -- The security of allowing proprietary development without divulging sensitive information. |
103 | | - |
104 | | -The Horizon SDK lets you write plugins that enable Deep Packet Inspection (DPI) on the traffic and detect threats in real time. The Horizon SDK makes extra customizations possible as well. For example, the Horizon SDK enables asset vendors, partners, or platform owners to localize and customize the text for alerts, events, and protocol parameters. |
105 | | - |
106 | | -[](media/concept-supported-protocols/sdk-horizon-expanded.png#lightbox) |
107 | | - |
108 | | -## Collaborate with the Horizon community |
109 | | - |
110 | | -Be part of a community that is leading the way toward digital transformation and industry-wide collaboration for protocol support. The Horizon ICS community allows knowledge sharing for domain experts in critical infrastructures, building management, production lines, transportation systems, and other industrial leaders. |
111 | | - |
112 | | -The community provides tutorials, discussion forums, instructor-led training, educational white papers, webinars, and more. |
113 | | - |
114 | | -We invite you to join our community here: <[email protected]> |
| 85 | +To join the Horizon community, email us at: [[email protected]](mailto:[email protected]) |
115 | 86 |
|
116 | 87 | ## Next steps |
117 | 88 |
|
118 | | -[Customize alert rules](how-to-accelerate-alert-incident-response.md#customize-alert-rules) |
119 | | -[About forwarded alert information](how-to-forward-alert-information-to-partners.md#about-forwarded-alert-information) |
| 89 | +For more information: |
| 90 | + |
| 91 | +- [Customize alert rules](how-to-accelerate-alert-incident-response.md#customize-alert-rules) |
| 92 | +- [About forwarded alert information](how-to-forward-alert-information-to-partners.md#about-forwarded-alert-information) |
0 commit comments