Azure Defender for IoT provides reference architecture for security agents that log, process, aggregate, and send security data through IoT Hub. Azure IoT security agents are designed to work in a constrained IoT environment, and are highly customizable in terms of values they provide when compared to the resources they consume.

Security agents support the following IoT solution features:

• Collect raw security events from the underlying OS (Linux, Windows). To learn more about available security data collectors, see Configure security agents.
• Aggregate raw security events into messages sent through IoT hub.
• Authenticate with existing device identity, or a dedicated module identity. See Security agent authentication methods to learn more.
• Configure remotely through use of the azureiotsecurity module twin. To learn more, see Configure security agents.

In this repository, you'll find useful scripts and snippets to get you started with Azure Defender for IoT.

• security_message - supported security event types, event schemas and event samples
• securty_module_twin - security agent configuration through IoT Hub module twin, twin schema, defaults, and automation scripts
• trigger_events - scripts to imitate malicious activity on an IoT device, in order to test and validate security agent proper behavior

Learn more about:

• Azure Defender for IoT security agents
• Azure Defender for IoT security agent reference architecture for C, on Github
• Azure Defender for IoT security agent reference architecture for C#, on Github

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com.

When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.