Sunturai
Back to results
MediumMicrosoft Sentinel analytics

Unauthorized device in the network (Microsoft Defender for IoT)

This alert leverages Defender for IoT to detect a new device indicating a legitimate device recently installed on the network or an indication of malicious activity such as a cyber threat attempting to manipulate the…

Description

This alert leverages Defender for IoT to detect a new device indicating a legitimate device recently installed on the network or an indication of malicious activity such as a cyber threat attempting to manipulate the SCADA network.

Detection logic

Detection requirements

Platform
None

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source product
iot
Log source service
securityalert_asc_for_iot

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice