Stefano Pescosolido

I’m a Technical Specialist in Microsoft, focused on IT Security technologies. I’m sharing here personal tips and experiences: nothing I write should be taken as an official opinion of my employer. My statements can be incomplete or even wrong. Please exercise caution when you evaluate my findings and comments. Apart from that, I hope that this content may be relevant and useful to others. Happy to share!

less than 1 minute read

Microsoft Sentinel has a specific Data Connector which allows to collect the alerts comining from Microsoft Defender for IoT. This data ingestion is free of charge.

data-conmector

A specific solution, available in the Sentinel’s Content Hub, allows to deploy Analytic Rules, Plabooks and a Workbook specialized for IoT/OT related security.

solution

More on that in the Microsoft Security’s video Better Together: Microsoft Sentinel - IT/OT Threat Monitoring with Defender for IoT Solution.

In the past few weeks I had the chance to collaborate with my great colleague Hesham Saad (Abdelaal), Sr. Global Cybersecurity Technical Specialist at Microsoft, in demonstrating how Microsof Sentinel can also collect the “raw data” produced by Microsoft Defender for IoT sensors and how Sentiel workbooks can leverage these raw data to give detailed information about the status and the history of the IoT/OT equipments monitored by the sensors. This raw data collection opens new scenarios for “IoT-enabled SOCs”.

Hesham and I have shown our experience in this new video, published in the Microsoft Defender for IoT Ninja training page and in the Microsoft Security Community channel in Youtube:

Microsoft Defender for IoT raw data in Microsoft Sentinel new-video

Hope you’ll find it interesting and useful!

You May Also Enjoy