|
2 | 2 | title: What's new in Microsoft Defender for IoT
|
3 | 3 | description: This article lets you know what's new in the latest release of Defender for IoT.
|
4 | 4 | ms.topic: overview
|
5 |
| -ms.date: 07/21/2022 |
| 5 | +ms.date: 08/07/2022 |
6 | 6 | ---
|
7 | 7 |
|
8 | 8 | # What's new in Microsoft Defender for IoT?
|
@@ -56,8 +56,7 @@ For more information, see the [Microsoft Security Development Lifecycle practice
|
56 | 56 | | 22.1.1 | 02/2022 | 10/2022 |
|
57 | 57 | | 10.5.5 | 12/2021 | 09/2022 |
|
58 | 58 | | 10.5.4 | 12/2021 | 09/2022 |
|
59 |
| -| 10.5.3 | 10/2021 | 07/2022 | |
60 |
| -| 10.5.2 | 10/2021 | 07/2022 | |
| 59 | + |
61 | 60 |
|
62 | 61 | ## July 2022
|
63 | 62 |
|
@@ -606,91 +605,6 @@ This new functionality is available on the following alerts:
|
606 | 605 | - Malware alerts, based on activity of the source device. (generated by the Malware engine).
|
607 | 606 | - Suspicion of Denial of Service Attack alerts, based on activity of the destination device (generated by the Malware engine)
|
608 | 607 |
|
609 |
| -## November 2021 |
610 |
| - |
611 |
| -**Sensor software version**: 10.5.3 |
612 |
| - |
613 |
| -The following feature enhancements are available with version 10.5.3 of Microsoft Defender for IoT. |
614 |
| - |
615 |
| -- The on-premises management console, has a new [ServiceNow Integration API - “/external/v3/integration/ (Preview)](references-work-with-defender-for-iot-apis.md#servicenow-integration-api---externalv3integration-preview). |
616 |
| - |
617 |
| -- Enhancements have been made to the network traffic analysis of multiple OT and ICS protocol dissectors. |
618 |
| - |
619 |
| -- As part of our automated maintenance, archived alerts that are over 90 days old will now be automatically deleted. |
620 |
| - |
621 |
| -- Many enhancements have been made to the exporting of alert metadata based on customer feedback. |
622 |
| - |
623 |
| -## October 2021 |
624 |
| - |
625 |
| -**Sensor software version**: 10.5.2 |
626 |
| - |
627 |
| -The following feature enhancements are available with version 10.5.2 of Microsoft Defender for IoT. |
628 |
| - |
629 |
| -- [PLC operating mode detections (Public Preview)](#plc-operating-mode-detections-public-preview) |
630 |
| - |
631 |
| -- [PCAP API](#pcap-api) |
632 |
| - |
633 |
| -- [On-premises Management Console Audit](#on-premises-management-console-audit) |
634 |
| - |
635 |
| -- [Webhook Extended](#webhook-extended) |
636 |
| - |
637 |
| -- [Unicode support for certificate passphrases](#unicode-support-for-certificate-passphrases) |
638 |
| - |
639 |
| -### PLC operating mode detections (Public Preview) |
640 |
| - |
641 |
| -Users can now view PLC operating mode states, changes, and risks. The PLC Operating mode consists of the PLC logical Run state and the physical Key state, if a physical key switch exists on the PLC. |
642 |
| - |
643 |
| -This new capability helps improve security by detecting *unsecure* PLCs, and as a result prevents malicious attacks such as PLC Program Downloads. The 2017 Triton attack on a petrochemical plant illustrates the effects of such risks. |
644 |
| -This information also provides operational engineers with critical visibility into the operational mode of enterprise PLCs. |
645 |
| - |
646 |
| -#### What is an unsecure mode? |
647 |
| - |
648 |
| -If the Key state is detected as Program or the Run state is detected as either Remote or Program the PLC is defined by Defender for IoT as *unsecure*. |
649 |
| - |
650 |
| -#### Visibility and risk assessment |
651 |
| - |
652 |
| -- Use the Device Inventory to view the PLC state of organizational PLCs, and contextual device information. Use the Device Inventory Settings dialog box to add this column to the Inventory. |
653 |
| - |
654 |
| - :::image type="content" source="media/release-notes/device-inventory-plc.png" alt-text="Device inventory showing PLC operating mode."::: |
655 |
| - |
656 |
| -- View PLC secure status and last change information per PLC in the Attributes section of the Device Properties screen. If the Key state is detected as Program or the Run state is detected as either Remote or Program the PLC is defined by Defender for IoT as *unsecure*. The Device Properties PLC Secured option will read false. |
657 |
| - |
658 |
| - :::image type="content" source="media/release-notes/attributes-plc.png" alt-text="Attributes screen showing PLC information."::: |
659 |
| - |
660 |
| -- View all network PLC Run and Key State statuses by creating a Data Mining with PLC operating mode information. |
661 |
| - |
662 |
| - :::image type="content" source="media/release-notes/data-mining-plc.png" alt-text="Data inventory screen showing PLC option."::: |
663 |
| - |
664 |
| -- Use the Risk Assessment Report to review the number of network PLCs in the unsecure mode, and additional information you can use to mitigate unsecure PLC risks. |
665 |
| - |
666 |
| -### PCAP API |
667 |
| - |
668 |
| -The new PCAP API lets the user retrieve PCAP files from the sensor via the on-premises management console with, or without direct access to the sensor itself. |
669 |
| - |
670 |
| -### On-premises Management Console audit |
671 |
| - |
672 |
| -Audit logs for the on-premises management console can now be exported to facilitate investigations into what changes were made, and by who. |
673 |
| - |
674 |
| -### Webhook extended |
675 |
| - |
676 |
| -Webhook extended can be used to send extra data to the endpoint. The extended feature includes all of the information in the Webhook alert and adds the following information to the report: |
677 |
| - |
678 |
| -- sensorID |
679 |
| -- sensorName |
680 |
| -- zoneID |
681 |
| -- zoneName |
682 |
| -- siteID |
683 |
| -- siteName |
684 |
| -- sourceDeviceAddress |
685 |
| -- destinationDeviceAddress |
686 |
| -- remediationSteps |
687 |
| -- handled |
688 |
| -- additionalInformation |
689 |
| - |
690 |
| -### Unicode support for certificate passphrases |
691 |
| - |
692 |
| -Unicode characters are now supported when working with sensor certificate passphrases. For more information, see [About certificates](how-to-deploy-certificates.md#about-certificates) |
693 |
| - |
694 | 608 | ## Next steps
|
695 | 609 |
|
696 | 610 | [Getting started with Defender for IoT](getting-started.md)
|
0 commit comments