Defender for IoT device inventory

Defender for IoT's device inventory helps you identify details about specific devices, such as manufacturer, type, serial number, firmware, and more. Gathering details about your devices helps your teams proactively investigate vulnerabilities that can compromise your most critical assets.

• Manage all your IoT/OT devices by building up-to-date inventory that includes all your managed and unmanaged devices

• Protect devices with risk-based approach to identify risks such as missing patches, vulnerabilities and prioritize fixes based on risk scoring and automated threat modeling

• Update your inventory by deleting irrelevant devices and adding organization-specific information to emphasize your organization preferences

For example:

Supported devices

Defender for IoT's device inventory supports the following device classes:

A transient device type indicates a device that was detected for only a short time. We recommend investigating these devices carefully to understand their impact on your network.

Unclassified devices are devices that don't otherwise have an out-of-the-box category defined.

Device management options

Defender for IoT device inventory is available in the following locations:

For more information, see:

• Manage your device inventory from the Azure portal
• Defender for Endpoint device discovery
• Manage your OT device inventory from a sensor console
• Manage your OT device inventory from an on-premises management console

Automatically consolidated devices

When you've deployed Defender for IoT at scale, with several OT sensors, each sensor might detect different aspects of the same device. To prevent duplicated devices in your device inventory, Defender for IoT assumes that any devices found in the same zone, with a logical combination of similar characteristics, is the same device. Defender for IoT automatically consolidates these devices and lists them only once in the device inventory.

For example, any devices with the same IP and MAC address detected in the same zone are consolidated and identified as a single device in the device inventory. If you have separate devices from recurring IP addresses that are detected by multiple sensors, you want each of these devices to be identified separately. In such cases, onboard your OT sensors to different zones so that each device is identified as a separate and unique device, even if they have the same IP address. Devices that have the same MAC addresses, but different IP addresses aren't merged, and continue to be listed as unique devices.

A transient device type indicates a device that was detected for only a short time. We recommend investigating these devices carefully to understand their impact on your network.

Unclassified devices are devices that don't otherwise have an out-of-the-box category defined.

Unauthorized devices

When you're first working with Defender for IoT, during the learning period just after deploying a sensor, all devices detected are identified as authorized devices.

After the learning period is over, any new devices detected are considered to be unauthorized and new devices. We recommend checking these devices carefully for risks and vulnerabilities. For example, in the Azure portal, filter the device inventory for Authorization == **Unauthorized**. On the device details page, drill down and check for related vulnerabilities, alerts, and recommendations.

The new status is removed as soon as you edit any of the device details or move the device on an OT sensor device map. In contrast, the unauthorized label remains until you manually edit the device details and mark it as authorized.

On an OT sensor, unauthorized devices are also included in the following reports:

• Attack vector reports: Devices marked as unauthorized are included in an attack vector simulation as suspected rogue devices that might be a threat to the network.

• Risk assessment reports: Devices marked as unauthorized are listed in risk assessment reports as their risks to your network require investigation.

Important OT devices

Mark OT devices as important to highlight them for extra tracking. On an OT sensor, important devices are included in the following reports:

• Attack vector reports: Devices marked as important are included in an attack vector simulation as possible attack targets.

• Risk assessment reports: Devices marked as important are counted in risk assessment reports when calculating security scores.

Device inventory column data

The following table lists the columns available in the Defender for IoT device inventory on the Azure portal. Starred items (*) are also available from the OT sensor.

The following columns are available on OT sensors only:

• The device's DHCP Address
• The device's FQDN address and FQDN Last Lookup Time
• The device Groups that include the device, as defined on the OT sensor's device map
• The device's Module address
• The device's Rack and Slot
• The number of Unacknowledged Alerts alerts associated with the device

Next steps

For more information, see:

• Manage your device inventory from the Azure portal
• Manage your OT device inventory from a sensor console
• Manage your OT device inventory from an on-premises management console
• Microsoft Defender for IoT - supported IoT, OT, ICS, and SCADA protocols
• Investigate devices on a device map