Skip to content

Commit ced7a7b

Browse files
v-thepetv-thepet
committed
Merge branch 'master' of https://github.com/MicrosoftDocs/azure-docs-pr into quickstarts1
2 parents 437060f + 8b9615f commit ced7a7b

File tree

18 files changed

+1331
-34
lines changed

18 files changed

+1331
-34
lines changed

‎articles/asc-for-iot/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,8 @@
3737
href: concept-security-module.md
3838
- name: Security alerts
3939
href: concept-security-alerts.md
40+
- name: Customizable security alerts
41+
href: concept-customizable-security-alerts.md
4042
- name: Security recommendations
4143
href: concept-recommendations.md
4244
- name: Baseline

‎articles/asc-for-iot/concept-customizable-security-alerts.md

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
---
2+
title: Customizable security alert guide for Azure Security Center for IoT| Microsoft Docs
3+
description: Learn about customizable security alerts and recommended remediation using Azure Security Center for IoT features and service.
4+
services: asc-for-iot
5+
ms.service: asc-for-iot
6+
documentationcenter: na
7+
author: mlottner
8+
manager: rkarlin
9+
editor: ''
10+
11+
ms.subservice: asc-for-iot
12+
ms.devlang: na
13+
ms.topic: conceptual
14+
ms.tgt_pltfrm: na
15+
ms.workload: na
16+
ms.date: 1/27/2020
17+
ms.author: mlottner
18+
19+
---
20+
# Azure Security Center for IoT security alerts
21+
22+
Azure Security Center for IoT continuously analyzes your IoT solution using advanced analytics and threat intelligence to alert you to malicious activity.
23+
24+
We encourage you to create custom alerts based on your knowledge of expected device behavior to ensure alerts act as the most efficient indicators of potential compromise in your unique organizational deployment and landscape.
25+
26+
The following list of Azure Security Center for IoT alerts are definable by you based on your expected IoT Hub and/or device behavior. For more details about how to customize each alert, see [create custom alerts](quickstart-create-custom-alerts.md).
27+
28+
## Azure Security Center for IoT alerts available for customization
29+
30+
31+
32+
| Severity | Alert name | Data source | Description | Suggested remediation|
33+
|---|---|---|---|---|
34+
| Low | Custom alert - number of cloud to device messages in AMQP protocol is outside the allowed range | IoT Hub | Number of cloud to device messages (AMQP protocol) within a specific time window is outside the currently configured and allowable range.||
35+
| Low | Custom alert - number of rejected cloud to device messages in AMQP protocol is outside the allowed range | IoT Hub | Number of cloud to device messages (AMQP protocol) rejected by the device, within a specific time window is outside the currently configured and allowable range.||
36+
| Low | Custom alert - number of device to cloud messages in AMQP protocol is outside the allowed range | IoT Hub | The amount of device to cloud messages (AMQP protocol) within a specific time window is outside the currently configured and allowable range.| |
37+
| Low | Custom alert - number of direct method invokes is outside the allowed range | IoT Hub | The amount of direct method invokes within a specific time window is outside the currently configured and allowable range.||
38+
| Low | Custom alert - number of file uploads is outside the allowed range | IoT Hub | The amount of file uploads within a specific time window is outside the currently configured and allowable range.| |
39+
| Low | Custom alert - number of cloud to device messages in HTTP protocol is outside the allowed range | IoT Hub | The amount of cloud to device messages (HTTP protocol) in a time window is not in the configured allowed range |
40+
| Low | Custom alert - number of rejected cloud to device messages in HTTP protocol is not in the allowed range | IoT Hub | The amount of cloud to device messages (HTTP protocol) within a specific time window is outside the currently configured and allowable range. |
41+
| Low | Custom alert - number of device to cloud messages in HTTP protocol is outside the allowed range | IoT Hub| The amount of device to cloud messages (HTTP protocol)within a specific time window is outside the currently configured and allowable range.| |
42+
| Low | Custom alert - number of cloud to device messages in MQTT protocol is outside the allowed range | IoT Hub | The amount of cloud to device messages (MQTT protocol) within a specific time window is outside the currently configured and allowable range.| |
43+
| Low | Custom alert - number of rejected cloud to device messages in MQTT protocol is outside the allowed range | IoT Hub | The amount of cloud to device messages (MQTT protocol) rejected by the device within a specific time window is outside the currently configured and allowable range. |
44+
| Low | Custom alert - number of device to cloud messages in MQTT protocol is outside the allowed range | IoT Hub | The amount of device to cloud messages (MQTT protocol) within a specific time window is outside the currently configured and allowable range.|
45+
| Low | Custom alert - number of command queue purges is outside the allowed range | IoT Hub | The amount of command queue purges within a specific time window is outside the currently configured and allowable range.||
46+
| Low | Custom alert - number of module twin updates is outside the allowed range | IoT Hub | The amount of module twin updates within a specific time window is outside the currently configured and allowable range.|
47+
| Low | Custom alert - number of unauthorized operations is outside the allowed range | IoT Hub | The amount of unauthorized operations within a specific time window is outside the currently configured and allowable range.|
48+
| Low | Custom alert - number of active connections is outside the allowed range | Agent | Number of active connections within a specific time window is outside the currently configured and allowable range.| Investigate the device logs. Learn where the connection originated and determine if it is benign or malicious. If malicious, remove possible malware and understand source. If benign, add the source to the allowed connection list. |
49+
| Low | Custom alert - outbound connection created to an IP that isn't allowed | Agent | An outbound connection was created to an IP that is outside your allowed IP list. |Investigate the device logs. Learn where the connection originated and determine if it is benign or malicious. If malicious, remove possible malware and understand source. If benign, add the source to the allowed IP list. |
50+
| Low | Custom alert - number of failed local logins is outside the allowed range | Agent | The amount of failed local logins within a specific time window is outside the currently configured and allowable range. | |
51+
| Low | Custom alert - login of a user that is not on the allowed user list | Agent | A local user outside your allowed user list, logged in to the device.| If you are saving raw data, navigate to your log analytics account and use the data to investigate the device, identify the source and then fix the allow/block list for those settings. If you are not currently saving raw data, go to the device and fix the allow/block list for those settings.|
52+
| Low | Custom alert - a process was executed that is not allowed | Agent | A process that is not allowed was executed on the device. |If you are saving raw data, navigate to your log analytics account and use the data to investigate the device, identify the source and then fix the allow/block list for those settings. If you are not currently saving raw data, go to the device and fix the allow/block list for those settings. |
53+
|
54+
55+
56+
## Next steps
57+
58+
- Learn how to [customize an alert](quickstart-create-custom-alerts.md)
59+
- Azure Security Center for IoT service [Overview](overview.md)
60+
- Learn how to [Access your security data](how-to-security-data-access.md)
61+
- Learn more about [Investigating a device](how-to-investigate-device.md)

‎articles/asc-for-iot/concept-security-alerts.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ ms.devlang: na
1414
ms.topic: conceptual
1515
ms.tgt_pltfrm: na
1616
ms.workload: na
17-
ms.date: 10/16/2019
17+
ms.date: 1/27/2020
1818
ms.author: mlottner
1919

2020
---
@@ -26,7 +26,7 @@ An alert acts as an indicator of potential compromise, and should be investigate
2626

2727
In this article, you will find a list of built-in alerts which can be triggered on your IoT Hub and/or IoT devices.
2828
In addition to built-in alerts, Azure Security Center for IoT allows you to define custom alerts based on expected IoT Hub and/or device behavior.
29-
For more details, see [Create custom alerts](quickstart-create-custom-alerts.md).
29+
For more details, see [customizable alerts](concept-customizable-security-alerts.md).
3030

3131
## Built-in alerts for IoT devices
3232

‎articles/asc-for-iot/overview.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: What is Azure Security Center for IoT | Microsoft Docs
3-
description: Learn more about Azure Security Center for IoT features and service, and understand how Azure Security Center for IoT provides comprehensive IoT security across all of your IoT assets.
3+
description: Learn more about Azure Security Center for IoT features and services, and understand how Azure Security Center for IoT provides comprehensive IoT security.
44
services: asc-for-iot
55
ms.service: asc-for-iot
66
documentationcenter: na

‎articles/asc-for-iot/quickstart-create-custom-alerts.md

Lines changed: 2 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ ms.devlang: na
1515
ms.topic: quickstart
1616
ms.tgt_pltfrm: na
1717
ms.workload: na
18-
ms.date: 11/08/2019
18+
ms.date: 1/27/2020
1919
ms.author: mlottner
2020

2121
---
@@ -76,30 +76,7 @@ Use security groups to group your devices into logical categories. After creatin
7676

7777
## Alerts available for customization
7878

79-
The following table provides a summary of alerts available for customization.
80-
81-
82-
| Severity | Name | Data Source | Description | Suggested remediation|
83-
|---|---|---|---|---|
84-
| Low | Custom alert - number of cloud to device messages in AMQP protocol is outside the allowed range | IoT Hub | Number of cloud to device messages (AMQP protocol) within a specific time window is outside the currently configured and allowable range.||
85-
| Low | Custom alert - number of rejected cloud to device messages in AMQP protocol is outside the allowed range | IoT Hub | Number of cloud to device messages (AMQP protocol) rejected by the device, within a specific time window is outside the currently configured and allowable range.||
86-
| Low | Custom alert - number of device to cloud messages in AMQP protocol is outside the allowed range | IoT Hub | The amount of device to cloud messages (AMQP protocol) within a specific time window is outside the currently configured and allowable range.| |
87-
| Low | Custom alert - number of direct method invokes is outside the allowed range | IoT Hub | The amount of direct method invokes within a specific time window is outside the currently configured and allowable range.||
88-
| Low | Custom alert - number of file uploads is outside the allowed range | IoT Hub | The amount of file uploads within a specific time window is outside the currently configured and allowable range.| |
89-
| Low | Custom alert - number of cloud to device messages in HTTP protocol is outside the allowed range | IoT Hub | The amount of cloud to device messages (HTTP protocol) in a time window is not in the configured allowed range |
90-
| Low | Custom alert - number of rejected cloud to device messages in HTTP protocol is not in the allowed range | IoT Hub | The amount of cloud to device messages (HTTP protocol) within a specific time window is outside the currently configured and allowable range. |
91-
| Low | Custom alert - number of device to cloud messages in HTTP protocol is outside the allowed range | IoT Hub| The amount of device to cloud messages (HTTP protocol)within a specific time window is outside the currently configured and allowable range.| |
92-
| Low | Custom alert - number of cloud to device messages in MQTT protocol is outside the allowed range | IoT Hub | The amount of cloud to device messages (MQTT protocol) within a specific time window is outside the currently configured and allowable range.| |
93-
| Low | Custom alert - number of rejected cloud to device messages in MQTT protocol is outside the allowed range | IoT Hub | The amount of cloud to device messages (MQTT protocol) rejected by the device within a specific time window is outside the currently configured and allowable range. |
94-
| Low | Custom alert - number of device to cloud messages in MQTT protocol is outside the allowed range | IoT Hub | The amount of device to cloud messages (MQTT protocol) within a specific time window is outside the currently configured and allowable range.|
95-
| Low | Custom alert - number of command queue purges is outside the allowed range | IoT Hub | The amount of command queue purges within a specific time window is outside the currently configured and allowable range.||
96-
| Low | Custom alert - number of module twin updates is outside the allowed range | IoT Hub | The amount of module twin updates within a specific time window is outside the currently configured and allowable range.|
97-
| Low | Custom alert - number of unauthorized operations is outside the allowed range | IoT Hub | The amount of unauthorized operations within a specific time window is outside the currently configured and allowable range.|
98-
| Low | Custom alert - number of active connections is outside the allowed range | Agent | Number of active connections within a specific time window is outside the currently configured and allowable range.| Investigate the device logs. Learn where the connection originated and determine if it is benign or malicious. If malicious, remove possible malware and understand source. If benign, add the source to the allowed connection list. |
99-
| Low | Custom alert - outbound connection created to an IP that isn't allowed | Agent | An outbound connection was created to an IP that is outside your allowed IP list. |Investigate the device logs. Learn where the connection originated and determine if it is benign or malicious. If malicious, remove possible malware and understand source. If benign, add the source to the allowed IP list. |
100-
| Low | Custom alert - number of failed local logins is outside the allowed range | Agent | The amount of failed local logins within a specific time window is outside the currently configured and allowable range. | |
101-
| Low | Custom alert - login of a user that is not on the allowed user list | Agent | A local user outside your allowed user list, logged in to the device.| If you are saving raw data, navigate to your log analytics account and use the data to investigate the device, identify the source and then fix the allow/block list for those settings. If you are not currently saving raw data, go to the device and fix the allow/block list for those settings.|
102-
| Low | Custom alert - a process was executed that is not allowed | Agent | A process that is not allowed was executed on the device. |If you are saving raw data, navigate to your log analytics account and use the data to investigate the device, identify the source and then fix the allow/block list for those settings. If you are not currently saving raw data, go to the device and fix the allow/block list for those settings. |
79+
Azure Security Center for IoT offers a large number of alerts which can be customized according to your specific needs. Review the [customizable alert table](concept-customizable-security-alerts.md) for alert severity, data source, description and our suggested remediation steps if and when each alert is received.
10380
|
10481

10582

‎articles/iot-dps/about-iot-dps.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ The Device Provisioning Service has many features, making it ideal for provision
7575
* **Enrollment list** containing the complete record of devices/groups of devices that may at some point register. The enrollment list contains information about the desired configuration of the device once it registers, and it can be updated at any time.
7676
* **Multiple allocation policies** to control how the Device Provisioning Service assigns devices to IoT hubs in support of your scenarios: Lowest latency, evenly weighted distribution (default), and static configuration via the enrollment list. Note that latency is determined using the same method as [Traffic Manager](https://docs.microsoft.com/azure/traffic-manager/traffic-manager-routing-methods#performance).
7777
* **Monitoring and diagnostics logging** to make sure everything is working properly.
78-
* **Multi-hub support** allows the Device Provisioning Service to assign devices to more than one IoT hub. The Device Provisioning Service can talk to hubs across multiple Azure subscriptions.
78+
* **Multi-hub support** allows the Device Provisioning Service to late-bind devices to an IoT hub at runtime. The Device Provisioning Service can talk to hubs across multiple Azure subscriptions.
7979
* **Cross-region support** allows the Device Provisioning Service to assign devices to IoT hubs in other regions.
8080

8181
You can learn more about the concepts and features involved in device provisioning in [device concepts](concepts-device.md), [service concepts](concepts-service.md), and [security concepts](concepts-security.md).

‎articles/iot-hub/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -378,6 +378,8 @@
378378
items:
379379
- name: Azure CLI
380380
href: /cli/azure/iot
381+
- name: Azure PowerShell
382+
href: /powershell/module/az.iothub#iot
381383
- name: .NET (Service)
382384
href: /dotnet/api/microsoft.azure.devices
383385
- name: .NET (Devices)

‎articles/load-balancer/load-balancer-custom-probe-overview.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,7 @@ Load Balancer is a pass through service (does not terminate TCP connections) and
195195

196196
UDP datagrams will be delivered to healthy backend endpoints.
197197

198-
UDP is connectionless and there is no flow state tracked for UDP. If any backend endpoint's health probe fails, existing UDP flows may move to another healthy instance in the backend pool.
198+
UDP is connectionless and there is no flow state tracked for UDP. If any backend endpoint's health probe fails, existing UDP flows will move to another healthy instance in the backend pool.
199199

200200
If all probes for all instances in a backend pool fail, existing UDP flows will terminate for Basic and Standard Load Balancers.
201201

0 commit comments

Comments
 (0)