Edit

Get started with Microsoft Defender for IoT device micro agents

  • Article

Defender for IoT security agents offers enhanced security capabilities, such as monitoring operating system configuration best practices. Take control of your device field threat protection and security posture with a single service.

The Defender for IoT security agents handle raw event collection from the device operating system, event aggregation to reduce cost, and configuration through a device module twin. Security messages are sent through your IoT Hub, into Defender for IoT analytics services.

Use the following workflow to deploy and test your Defender for IoT security agents:

  1. Enable Defender for IoT service to your IoT Hub.

  2. If your IoT Hub has no registered devices, Register a new device.

  3. Create a DefenderIotMicroAgent module twin for your devices.

  4. To install the agent on an Azure simulated device instead of installing on an actual device, spin up a new Azure Virtual Machine (VM).

  5. Deploy a Defender for IoT security agent on your IoT device, or new VM.

  6. Follow the instructions for trigger_events to run an OS baseline event.

  7. Verify Defender for IoT recommendations in response to the simulated OS baseline check failure in the previous step. Begin verification 30 minutes after running the script.

Next steps