↳ GitHub sourceAnalytics ruleMedium

Unauthorized device in the network (Microsoft Defender for IoT)

Description

'This alert leverages Defender for IoT to detect a new device indicating a legitimate device recently installed on the network or an indication of malicious activity such as a cyber threat attempting to manipulate the SCADA network.'

Rule type: Scheduled
Version: 1.0.3
Declared status: Available
Query frequency: 1h
Query period: 1h
Trigger: gt 0

Declared MITRE coverage

Discovery T0842

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

IoT

Data types

SecurityAlert (ASC for IoT)

KQL query

Original query, unchanged.

SecurityAlert
| where ProviderName == "IoTSecurity"
| where AlertName in ("Field Device Discovered Unexpectedly", "New Asset Detected", "Abnormal usage of MAC Addresses", "New LLDP Device Configuration")
| extend ExtendedProperties = parse_json(ExtendedProperties)
| where tostring(ExtendedProperties.isNew) == "True"
| extend DeviceId = tostring(ExtendedProperties.DeviceId), 
         SourceDeviceAddress = tostring(ExtendedProperties.SourceDeviceAddress), 
         DestDeviceAddress = tostring(ExtendedProperties.DestinationDeviceAddress), 
         RemediationSteps = tostring(parse_json(RemediationSteps)[0]), 
         Protocol = tostring(ExtendedProperties.Protocol), 
         AlertManagementUri = tostring(ExtendedProperties.AlertManagementUri)
| project
  TimeGenerated,
  DeviceId,
  ProductName,
  ProductComponentName,
  AlertSeverity,
  AlertName,
  Description,
  Protocol,
  SourceDeviceAddress,
  DestDeviceAddress,
  RemediationSteps,
  Tactics,
  Entities,
  VendorOriginalId,
  AlertLink,
  AlertManagementUri,
  Techniques

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTUnauthorizedDevice.yaml ↗
Commit: 9800e51 ↗
Source identifier: f4c71e55-6192-47ca-92e2-0856ae502a46

Additional source files 2

Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTUnauthorizedDevice.yamlsource ↗Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Data/Solution_IoTOTThreatMonitoringwithDefenderforIoT.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.