Microsoft Defender for IoT Ninja Training

[kimwall]

The following courses will guide you to becoming an Microsoft Defender for IoT Ninja. 

Curriculum  

This training program includes over 28 videos divided into 5 modules. For each session, the post includes a video, and/or a presentation, along with supporting information when relevant: product documentation, blog posts, and additional resources. 
 
The modules are organized into the following groups: 

• Overview 
• Basic Features 
• Deployment 
• Sentinel Integration 
• Advanced  

Check back often as additional items will be published regularly.

Overview 

Microsoft Defender for IoT enables IT and OT teams to auto-discover their unmanaged IoT/OT assets, identify critical vulnerabilities, and detect anomalous or unauthorized behavior — without impacting IoT/OT stability or performance. 

Microsoft Defender for IoT delivers insights within minutes of being connected to the network, leveraging patented IoT/OT-aware behavioral analytics and machine learning to eliminate the need to configure any rules, signatures, or other static IOCs. To capture the traffic, it uses an on-premises network sensor deployed as a virtual or physical appliance connected to a SPAN port or tap. The sensor implements non-invasive passive monitoring with Network Traffic Analysis (NTA) and Layer 7 Deep Packet Inspection (DPI) to extract detailed IoT/OT information in real-time.

This section provides background information on IoT and OT networks and an overview of the Microsoft Defender for IoT platform.

Start Here

17m: How does Microsoft Defender for IoT secure OT (operational technology) environments?    How does Microsoft Defender for IoT secure OT (operational technology) environments?   12m: What is the Microsoft Defender for IoT Architecture?   What is the Microsoft Defender for IoT Architecture?   4m: Microsoft Defender for IoT Reference Architecture

Learn More

Blog: Go inside the new Microsoft Defender for IoT including CyberX   22m: Agentless IoT/OT security with Microsoft Defender for IoT   35m: Microsoft Defender for IoT Overview    25m: Microsoft Defender for IoT Introduction   38m: What is OT and how is it different from IT?   23m: How Microsoft Defender for IoT fills the security gap in OT networks   13m: Microsoft Defender for IoT overview and demo   13m: Microsoft Defender for IoT agentless monitoring demo  Blog: Designing a Robust Defense for Operational Technology Using Microsoft Defender for IoT Blog: Microsoft scores highest in threat visibility coverage for MITRE ATT&CK for ICS Blog: How to gain more from your connection to an OT network

Basic Features 

Learn about the core features of the platform including asset discovery, deployment options, reporting, alert handling, event timeline, risk assessment, attack vector simulations, and data mining and baselining.  

Start Here

43m: Demonstration of Microsoft Defender for IoT platform  Demonstration of Microsoft Defender for IoT platform   10m: How to discover and classify assets within your industrial network using Defender for IoT   Asset discovery solution brief  6m: How to discover exploitable paths using attack vector simulation   How to discover exploitable paths using attack vector simulation   8m: How to run reports and attack vector simulations   How to run reports and attack vector simulations   5m: How to use the event timeline   11m: How to analyze the risk assessment report   Sample Risk Assessment report  9m: How to handle Microsoft Defender for IoT Alerts  How to handle Microsoft Defender for IoT Alerts  5m: How data mining and baselining works in Microsoft Defender for IoT  How data mining and baselining works in Microsoft Defender for IoT

Learn More

Doc: Working with the device inventory Doc: Working with the Event Timeline Doc: Risk Assessment Reporting Doc: Understanding Sensor Alerts Doc: Alert types and descriptions Doc: Creating Data Mining Reports  52m: Zero Trust Webinar with Microsoft Defender for IoT   24m: Analytics, data management and hunting with Microsoft Defender for IoT   24m: Deployment methodologies - hybrid cloud vs air-gapped environments  Doc: Microsoft Defender for IoT Architecture in product documentation  Blog: Cloud-delivered IoT/OT threat intelligence  Blog: Microsoft Defender for IoT quick start instructions

Deployment 

This section provides details on the deployment and tuning specifics. Learn about the differences between on-premises-only and cloud-connected options. Walk through the licensing components within the Azure portal.  

Start Here	35m: How to successfully deploy a sensor   How to successfully deploy a sensor  15m: How to optimize and tune the Microsoft Defender for IoT platform  How to optimize and tune the Microsoft Defender for IoT platform
Learn More	Doc: Setting up your Defender for IoT network Blog: Designing a Robust Defense for Operational Technology Using Microsoft Defender for IoT   33m: Deploying and configuring an offline sensor

Sentinel Integration 

For cloud-connected options, remote sensors will send logging and analysis data to Azure. Once in the cloud, logging and asset data may be forwarded to Sentinel. All of the tools within Sentinel become available including automation/playbooks, workbooks, threat hunting and analytics, incident handling, notebooks, and more.  

Start Here

16m: How to protect OT networks from Triton using Microsoft Sentinel Playbooks   5m: How Microsoft Defender for IoT uses the IoT Hub  5m: How to share Defender for IoT Raw Data with Sentinel

Advanced 

Learn about advanced features and integrations including custom alerts, MITRE framework, enterprise data integration, large scale deployments, SOC integration, and more.  

Start Here	13m: How to use the enterprise data integrator   How to use the enterprise data integrator   12m: How to create custom alerts in Defender for IoT   53m: How Defender for IoT maps to MITRE ATT&CK  How Defender for IoT maps to MITRE ATT&CK   5m: Integrating with Splunk and ServiceNow  53m: Large scale deployment of Defender for IoT   Large scale deployment of Defender for IoT
Learn More	Blog: Looking for Anomalies in your IoT Asset Telemetry  Doc: Creating Custom Alerts  Doc: Integrating data into the enterprise device inventory Blog: Microsoft Defender for IoT Raw-Data and ICS MITRE ATT&CK Matrix Mapping via Azure Sentinel

Microsoft Defender for IoT Product Documentation 

You may find product documentation in the Azure portal: 

• Microsoft Defender for IoT Getting Started launch page 

• Hardware Specifications Guide 
• Network Setup Guide 
• Installation Guide 
• Microsoft Defender for IoT Web Page 
• IoT Security - Microsoft Tech Community 

[James van den Berg]

Thank you @kimwall for Sharing with the Community 

[David Caddick]

@kimwall as per @James van den Berg comment - thanks massively for sharing.

Quick question if I may? as I'm under a time crunch

When are the slide decks going to be available?

I'm specifically looking for the L300/400 details of exactly *how* the OT devices are secured in Air-gapped environments if the solution is relying on an agentless solution? how can that protect devices from potentially malicious content on USB devices being introduced inadvertently?

Regards,
Dave C

[kimwall]

Hello David. Apologies for the delay in answering your question. I've been out of the country for a few weeks. We are working on getting the slide decks/PDF's posted. However, I do not believe they will help with your specific question. When deploying Defender for IoT in an air-gapped environment, the sensor may be locally accessed and monitored without the need for a central manager. This solution is agentless and out-of-band and therefore not inline to any traffic. This is by design. Most industrial network owners resist solutions which are inline, place packets on the process control network, or require an in-band endpoint agent (any of these could potentially cause unplanned downtime, which is high on the list of things which should never happen in OT networks). Defender for IoT operates on SPAN'd/brokered network traffic and would see malicious activities when they happen - regardless of where they originate, including USB media. Note that the connection of the USB is not something that will be seen with this solution, but any network activity generated will be seen. Using patented machine-to-machine analytics, a baseline is learned and continually adjusted to ensure that good/authorized traffic is always known. When malicious traffic is introduced to the environment, it will inevitably deviate from the baseline of what is known to be good and one or more alerts will be raised at that time. 

[David Caddick]

Thanks @kimwall,

We had a good discussion with customer and Lior - my bad, as it was the customer leading me astray with their specific use case.
When in reality they should be doing things correctly/securely and not necessarily taking shortcuts?

Regards,

Dave C  

[Dean Gross]

@David Caddick the slide decks have been added

Remind your customers that taking shortcuts frequently results in making it easier for attackers and cost more in the long run. 

[Dean Gross]

@kimwall The Defender for IoT Architecture deck is still referring to CyberX. How much longer should we use that companies names in discussions with our Clients? they were purchase by MS quite a while ago. 

[Dean Gross]

@kimwall  In the Sentinel Integration section, the link to Doc: Security Operations, Automation, and Response with Azure Sentinel does not work

[kimwall]

@Dean Gross, thank you for pointing out the mis-functioning link. It has been removed for now. As for references to CyberX, I came to Microsoft as a part of that acquisition  and am very much aware that the name has changed to Azure Defender for IoT. However, in the case of this video and deck, they were recorded shortly after the acquisition so it made sense to mention both. Going forward, this won't be the case, but depending on the session on this page, you may see or hear the previous name a time or two. Old habits die hard, but we are getting there. 

[Peter_Addison]

Hi There,

Enjoying this ninja and wondered if you could suggest a pcap source file that might be available to act as a useful training proof of concept that could be imported into a Sensor?

Thank you for all the great material.

Br Pete

[FransPAva]

Hello @kimwall and all,

I am enjoying studying the pile of material and yesterday my knowledge was further enriched by attending the Microsoft Security Partner Airlift FY22 – Secure OT/IoT Training.

Two questions remain: 1) what is the best way to achieving a certificate and 2) I ran into a mention of AZ-220, does it cover what we are learning on this Ninja page?

Kind regards,

-Frans

[nothing123]

Hi There,

Great work and it is very useful.

Thank you for all the great material.

Regards,
Neeraj 

[Peter_Addison]

AZ-220 is more focused on sensors in general, managing them, configuring the Azure workspace to use the data sent by them not necessarily sending data to Sentinel but where the data may have a business meaning e.g. condition monitoring, so things like PowerBI might be used along with hot/cold storage to analyse real/non-realtime.

[LinuVarghese]

Hi Microsoft Defender for IoT Team,

Will Microsoft be maintaining the CyberX app for QRadar?  We have a customer that is using the CyberX sensors in their production facilities and it is integrated to the QRadar SIEM deployed ion their data center using the CyberX app for QRadar.  This app has not been updated since  2017 .

[Dean Gross]

In the How to use the Enterprise Data Integrator recording, it was mentioned that we could use the native token generation capability to avoid putting passwords into scripts. Can we use Azure Managed Identities or Key Vault with Defender for IoT for this purpose?

[kk5626]

It seems certification missing..

[MarcoFekry]

Hi ,

Very useful documentation and training

Thank you

[ry__panov__]

Will there ever be a MS accredited Defender for IoT course? These materials are great, but it would be better for clients/consultants alike if one could achieve admin/user/analyst accreditations. 

[Dean Gross]

@kimwall most of this material is over 1 year old and there have been many changes since then. Are there any plans to update this content?