{"id":"5c427fe2-e8b6-4e83-941a-5b48030f2e64","shortId":"wZpDhd","kind":"skill","title":"azure-defender-for-iot","tagline":"Expert knowledge for Azure Defender For Iot development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when deploying OT sensors, configuring","description":"# Azure Defender For Iot Skill\n\nThis skill provides expert guidance for Azure Defender For Iot. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.\n\n## How to Use This Skill\n\n> **IMPORTANT for Agent**: Use the **Category Index** below to locate relevant sections. For categories with line ranges (e.g., `L35-L120`), use `read_file` with the specified lines. For categories with file links (e.g., `[security.md](security.md)`), use `read_file` on the linked reference file\n\n> **IMPORTANT for Agent**: If `metadata.generated_at` is more than 3 months old, suggest the user pull the latest version from the repository. If `mcp_microsoftdocs` tools are not available, suggest the user install it: [Installation Guide](https://github.com/MicrosoftDocs/mcp/blob/main/README.md)\n\nThis skill requires **network access** to fetch documentation content:\n- **Preferred**: Use `mcp_microsoftdocs:microsoft_docs_fetch` with query string `from=learn-agent-skill`. Returns Markdown.\n- **Fallback**: Use `fetch_webpage` with query string `from=learn-agent-skill&accept=text/markdown`. Returns Markdown.\n\n## Category Index\n\n| Category | Lines | Description |\n|----------|-------|-------------|\n| Troubleshooting | L37-L45 | Troubleshooting Defender for IoT micro agents and OT sensors, validating sensor installs, interpreting sensor health messages, and understanding built‑in sensor alert types. |\n| Best Practices | L46-L53 | Best practices for OT/ICS: using CIS benchmarks, designing monitoring topology, planning sensor placement at sites, and optimizing alert triage and response workflows. |\n| Decision Making | L54-L65 | Guidance on choosing OT traffic mirroring methods, licenses, and appliances, plus planning billing, console retirement, cloud transition, and tracking Defender for IoT OT software versions. |\n| Architecture & Design Patterns | L66-L72 | OT network architectures for connecting sensors to Azure, sample connectivity models, and mapping Defender for IoT components to Purdue OT network layers. |\n| Limits & Quotas | L73-L83 | Data residency, retention limits, feature lifecycle, supported/archived OT sensors, virtual appliance requirements, and networking/port prerequisites for Defender for IoT. |\n| Security | L84-L107 | Security alerts, recommendations, roles, auth, and certificates for Defender for IoT/IoT Hub/OT sensors, including RBAC, SSO, PAM auditing, and Zero Trust monitoring. |\n| Configuration | L108-L131 | Configuring Defender for IoT micro agents and OT sensors: setup, OS dependencies, monitoring modes, networking/proxy/DNS/firewall, sensor management, maintenance, and auditing activity. |\n| Integrations & Coding Patterns | L132-L166 | Integrating Defender for IoT with SIEMs, firewalls, ServiceNow, Sentinel, and partner tools, plus APIs, micro agent provisioning, traffic mirroring, and automation patterns. |\n| Deployment | L167-L189 | Hardware/VM requirements and step-by-step guides to deploy, configure, mirror traffic, back up, restore, and update Defender for IoT OT sensor appliances and VMs. |\n\n### Troubleshooting\n| Topic | URL |\n|-------|-----|\n| Troubleshoot Defender for IoT micro agent issues | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/troubleshoot-defender-micro-agent |\n| Reference for Defender for IoT sensor alert types | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/alert-engine-messages |\n| Troubleshoot Microsoft Defender for IoT OT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-troubleshoot-sensor |\n| Validate Defender for IoT OT sensor software installation | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/post-install-validation-ot-software |\n| Interpret Defender for IoT sensor health messages | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/sensor-health-messages |\n\n### Best Practices\n| Topic | URL |\n|-------|-----|\n| Investigate CIS benchmark recommendations in Defender | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-investigate-cis-benchmark |\n| Plan OT monitoring topology with Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/plan-corporate-monitoring |\n| Prepare OT sites and sensor placement for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/plan-prepare-deploy |\n| Optimize OT alert workflows on Defender for IoT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-accelerate-alert-incident-response |\n\n### Decision Making\n| Topic | URL |\n|-------|-----|\n| Choose OT traffic mirroring methods for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/traffic-mirroring-methods |\n| Decide between SPAN, RSPAN, ERSPAN for OT mirroring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/traffic-mirroring-methods |\n| Plan Defender for IoT billing and licensing | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/billing |\n| Choose and extend Defender for IoT licenses | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/license-and-trial-license-extention |\n| Select appropriate OT appliances for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-appliance-sizing |\n| Plan for Defender for IoT on-premises console retirement | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/on-premises-management-console-retirement |\n| Transition Defender for IoT management from on-premises to cloud | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/transition-on-premises-management-console-to-cloud |\n| Track Defender for IoT OT software versions and support | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/release-notes |\n\n### Architecture & Design Patterns\n| Topic | URL |\n|-------|-----|\n| Select architectures to connect OT sensors to Azure | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/architecture-connections |\n| Use sample OT network connectivity models for sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/sample-connectivity-models |\n| Map Defender for IoT to Purdue OT network layers | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/understand-network-architecture |\n\n### Limits & Quotas\n| Topic | URL |\n|-------|-----|\n| Understand Defender for IoT data residency mapping | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-data-processing |\n| Review Defender for IoT feature support lifecycle | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/edge-security-module-deprecation |\n| Networking requirements and ports for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/networking-requirements |\n| Review catalog of preconfigured OT monitoring appliances | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-pre-configured-appliances |\n| Check system requirements for virtual OT appliances | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-virtual-appliances |\n| Understand Defender for IoT data retention limits | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/references-data-retention |\n| Review archived Defender for IoT OT sensor versions | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/release-notes-ot-monitoring-sensor-archive |\n\n### Security\n| Topic | URL |\n|-------|-----|\n| Use Defender micro agent built-in security alerts | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-agent-based-security-alerts |\n| Define custom Defender for IoT Hub alerts | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-customizable-security-alerts |\n| Apply Defender for IoT Hub security recommendations | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-recommendations |\n| Use Defender for IoT Hub built-in alerts | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-security-alerts |\n| Use ThreadX micro agent alerts and recommendations | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-threadx-security-alerts-recommendations |\n| Configure PAM auditing for Defender sign-in events | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/configure-pam-to-audit-sign-in-events |\n| Create and assign custom Defender device alerts | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/quickstart-create-custom-alerts |\n| Call Defender for IoT sensor authentication APIs | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-auth-apis |\n| Meet SSL/TLS certificate requirements for OT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/certificate-requirements |\n| Review Defender for IoT compliance and certifications | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/compliance |\n| Enable enterprise IoT security in Defender for Endpoint | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/eiot-defender-for-endpoint |\n| Manage Defender for IoT users and roles | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/manage-users-overview |\n| Assign Azure RBAC roles for Defender for IoT access | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/manage-users-portal |\n| Manage on-premises users on Defender for IoT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/manage-users-sensor |\n| Apply Zero Trust monitoring to OT networks with Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/monitor-zero-trust |\n| Create CA-signed SSL/TLS certificates for OT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/create-ssl-certificates |\n| Use Defender for IoT security recommendations to reduce OT risk | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/recommendations |\n| Map Azure RBAC roles to Defender for IoT actions | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/roles-azure |\n| Configure on-premises Defender for IoT user roles | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/roles-on-premises |\n| Configure SSO with Entra ID for IoT sensor console | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/set-up-sso |\n\n### Configuration\n| Topic | URL |\n|-------|-----|\n| Configure Defender for IoT micro agent behavior | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-micro-agent-configuration |\n| Review Linux OS dependencies for Defender micro agent | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-micro-agent-linux-dependencies |\n| Configure DMI decoder for Defender micro agent | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-configure-dmi-decoder |\n| Configure Defender for IoT micro agent twin | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-configure-micro-agent-twin |\n| Configure Defender micro agent for Eclipse ThreadX | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-threadx-security-module |\n| Use Defender for IoT OT sensor CLI commands | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/cli-ot-sensor |\n| Configure OT active monitoring methods in Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/configure-active-monitoring |\n| Configure reverse DNS lookup for OT device enrichment | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/configure-reverse-dns-lookup |\n| Configure OT sensor settings centrally from Azure portal | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/configure-sensor-settings-portal |\n| Set up Windows Endpoint Monitoring for OT networks | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/configure-windows-endpoint-monitoring |\n| Configure OT sensor proxy connections to Azure | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/connect-sensors |\n| Import supplemental OT device data into sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-import-device-information |\n| Perform OT sensor maintenance via sensor console GUI | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-manage-individual-sensors |\n| Manage Defender for IoT sensors in Azure portal | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-manage-sensors-on-the-cloud |\n| Set up SNMP MIB health monitoring for OT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-set-up-snmp-mib-monitoring |\n| Manage threat intelligence package updates on OT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-work-with-threat-intelligence-packages |\n| Onboard OT sensors to Defender for IoT in Azure | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/onboard-sensors |\n| Configure and activate Microsoft Defender for IoT OT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/activate-deploy-sensor |\n| Configure firewall endpoints for OT sensor cloud management | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/provision-cloud-management |\n| Audit and track Defender for IoT user activity | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/track-user-activity |\n\n### Integrations & Coding Patterns\n| Topic | URL |\n|-------|-----|\n| Provision Defender micro agent with DPS and X.509 | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-provision-micro-agent |\n| Use Defender micro agent API for Eclipse ThreadX | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/threadx-security-module-api |\n| Manage OT sensor alerts using Defender for IoT APIs | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-alert-apis |\n| Manage OT sensor inventory via Defender for IoT APIs | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-inventory-apis |\n| Access OT vulnerability data via Defender for IoT APIs | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-vulnerability-apis |\n| Automate OT sensor disconnection alerts with Sentinel playbooks | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/automate-sensor-disconnection-alerts |\n| Enrich Windows endpoint data using local script | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/detect-windows-endpoints-script |\n| Forward OT sensor alerts to partner systems and syslog | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-forward-alert-information-to-partners |\n| Choose and configure Defender for IoT partner integrations | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrate-overview |\n| Integrate ArcSight with Defender for IoT alert forwarding | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/arcsight |\n| Send Defender for IoT alerts to LogRhythm SIEM | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/logrhythm |\n| Integrate RSA NetWitness with Defender for IoT alerts | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/netwitness |\n| Connect on-premises Defender for IoT sensors to Sentinel (legacy) | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/on-premises-sentinel |\n| Stream Defender for IoT cloud alerts to third-party SIEMs | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/send-cloud-data-to-partners |\n| Configure legacy ServiceNow integration for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/service-now-legacy |\n| Use Sentinel solution to investigate Defender for IoT threats | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/iot-advanced-threat-monitoring |\n| Connect Defender for IoT with Microsoft Sentinel via data connector | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/iot-solution |\n| Integrate with Microsoft Defender for IoT REST APIs | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/references-work-with-defender-for-iot-apis |\n| Configure Cisco ERSPAN for Defender for IoT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-erspan |\n| Use ESXi vSwitch promiscuous mode for OT traffic mirroring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-esxi |\n| Use Hyper-V vSwitch promiscuous mode for OT mirroring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-hyper-v |\n| Configure Cisco RSPAN mirroring for OT monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-rspan |\n| Configure Cisco SPAN ports for Defender for IoT traffic mirroring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-span |\n| Integrate CyberArk with Defender for IoT for credential security | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-cyberark |\n| Integrate Forescout with Defender for IoT for OT visibility | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-forescout |\n| Integrate Fortinet firewalls with Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-fortinet |\n| Integrate Palo Alto firewalls with Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-palo-alto |\n| Integrate IBM QRadar with Defender for IoT alerts | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-qradar |\n| Integrate ServiceNow OT Manager with Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-servicenow |\n| Integrate Splunk with Microsoft Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-splunk |\n| Visualize Defender for IoT data with Azure Monitor workbooks | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/workbooks |\n\n### Deployment\n| Topic | URL |\n|-------|-----|\n| Select and use OT monitoring appliances for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/ |\n| Deploy Dell PowerEdge R350 for OT sensor monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r350-e1800 |\n| Deploy Dell PowerEdge R360 for OT sensor monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r360-e1800 |\n| Deploy Dell PowerEdge R660 for OT sensor monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r660 |\n| Deploy Heptagon YB3x appliance for OT monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/heptagon-yb3x |\n| Use HPE ProLiant DL20 Gen 11 (4SFF) for OT monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-gen-11 |\n| Use HPE ProLiant DL20 Gen 11 (2LFF) for OT monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-gen-11-nhp-2lff |\n| Use legacy HPE ProLiant DL20 for enterprise OT monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-legacy |\n| Use HPE ProLiant DL20 Gen10 Plus for enterprise OT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-plus-enterprise |\n| Use HPE ProLiant DL20 Gen10 Plus (2LFF) for SMB OT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-plus-smb |\n| Deploy Defender for IoT on HPE ProLiant DL360 | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl360 |\n| Deploy Defender for IoT on HPE ProLiant DL360 Gen 11 | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl360-gen11 |\n| Deploy Defender for IoT OT sensor VM on Hyper-V Gen 2 | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/virtual-sensor-hyper-v |\n| Deploy Defender for IoT OT sensor VM on VMware ESXi | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/virtual-sensor-vmware |\n| Deploy YS-techsystems YS-FIT2 for OT monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/ys-techsystems-ys-fit2 |\n| Back up and restore Defender for IoT OT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/back-up-restore-sensor |\n| Plan hybrid or air-gapped Defender for IoT deployments | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/air-gapped-deploy |\n| Install and initially configure Defender for IoT OT sensor software | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/install-software-ot-sensor |\n| Deploy OT sensors with correct traffic mirroring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/set-up-traffic-mirroring |\n| Update Defender for IoT OT sensor software versions | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/update-ot-software |","tags":["azure","defender","for","iot","agent","skills","microsoftdocs","agent-skills","agentic-skills","agentskill","ai-agents","ai-coding"],"capabilities":["skill","source-microsoftdocs","skill-azure-defender-for-iot","topic-agent","topic-agent-skills","topic-agentic-skills","topic-agentskill","topic-ai-agents","topic-ai-coding","topic-azure","topic-azure-functions","topic-azure-kubernetes-service","topic-azure-openai","topic-azure-sql-database","topic-azure-storage"],"categories":["Agent-Skills"],"synonyms":[],"warnings":[],"endpointUrl":"https://skills.sh/MicrosoftDocs/Agent-Skills/azure-defender-for-iot","protocol":"skill","transport":"skills-sh","auth":{"type":"none","details":{"cli":"npx skills add MicrosoftDocs/Agent-Skills","source_repo":"https://github.com/MicrosoftDocs/Agent-Skills","install_from":"skills.sh"}},"qualityScore":"0.700","qualityRationale":"deterministic score 0.70 from registry signals: · indexed on github topic:agent-skills · 549 github stars · SKILL.md body (22,789 chars)","verified":false,"liveness":"unknown","lastLivenessCheck":null,"agentReviews":{"count":0,"score_avg":null,"cost_usd_avg":null,"success_rate":null,"latency_p50_ms":null,"narrative_summary":null,"summary_updated_at":null},"enrichmentModel":"deterministic:skill-github:v1","enrichmentVersion":1,"enrichedAt":"2026-05-18T18:53:52.317Z","embedding":null,"createdAt":"2026-04-18T21:58:51.461Z","updatedAt":"2026-05-18T18:53:52.317Z","lastSeenAt":"2026-05-18T18:53:52.317Z","tsv":"'/en-us/azure/defender-for-iot/device-builders/concept-agent-based-security-alerts':793 '/en-us/azure/defender-for-iot/device-builders/concept-customizable-security-alerts':803 '/en-us/azure/defender-for-iot/device-builders/concept-data-processing':716 '/en-us/azure/defender-for-iot/device-builders/concept-micro-agent-configuration':1021 '/en-us/azure/defender-for-iot/device-builders/concept-micro-agent-linux-dependencies':1032 '/en-us/azure/defender-for-iot/device-builders/concept-recommendations':813 '/en-us/azure/defender-for-iot/device-builders/concept-security-alerts':825 '/en-us/azure/defender-for-iot/device-builders/concept-threadx-security-alerts-recommendations':835 '/en-us/azure/defender-for-iot/device-builders/configure-pam-to-audit-sign-in-events':847 '/en-us/azure/defender-for-iot/device-builders/edge-security-module-deprecation':726 '/en-us/azure/defender-for-iot/device-builders/how-to-configure-dmi-decoder':1042 '/en-us/azure/defender-for-iot/device-builders/how-to-configure-micro-agent-twin':1052 '/en-us/azure/defender-for-iot/device-builders/how-to-investigate-cis-benchmark':530 '/en-us/azure/defender-for-iot/device-builders/how-to-provision-micro-agent':1245 '/en-us/azure/defender-for-iot/device-builders/how-to-threadx-security-module':1062 '/en-us/azure/defender-for-iot/device-builders/quickstart-create-custom-alerts':857 '/en-us/azure/defender-for-iot/device-builders/threadx-security-module-api':1256 '/en-us/azure/defender-for-iot/device-builders/troubleshoot-defender-micro-agent':475 '/en-us/azure/defender-for-iot/organizations/alert-engine-messages':486 '/en-us/azure/defender-for-iot/organizations/api/sensor-alert-apis':1268 '/en-us/azure/defender-for-iot/organizations/api/sensor-auth-apis':867 '/en-us/azure/defender-for-iot/organizations/api/sensor-inventory-apis':1280 '/en-us/azure/defender-for-iot/organizations/api/sensor-vulnerability-apis':1292 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/':1608 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r350-e1800':1619 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r360-e1800':1630 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r660':1641 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/heptagon-yb3x':1651 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-gen-11':1664 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-gen-11-nhp-2lff':1677 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-legacy':1689 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-plus-enterprise':1701 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-plus-smb':1714 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl360':1725 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl360-gen11':1738 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/virtual-sensor-hyper-v':1754 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/virtual-sensor-vmware':1767 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/ys-techsystems-ys-fit2':1780 '/en-us/azure/defender-for-iot/organizations/architecture-connections':679 '/en-us/azure/defender-for-iot/organizations/automate-sensor-disconnection-alerts':1303 '/en-us/azure/defender-for-iot/organizations/back-up-restore-sensor':1792 '/en-us/azure/defender-for-iot/organizations/best-practices/certificate-requirements':877 '/en-us/azure/defender-for-iot/organizations/best-practices/plan-corporate-monitoring':541 '/en-us/azure/defender-for-iot/organizations/best-practices/plan-prepare-deploy':554 '/en-us/azure/defender-for-iot/organizations/best-practices/sample-connectivity-models':690 '/en-us/azure/defender-for-iot/organizations/best-practices/traffic-mirroring-methods':582,593 '/en-us/azure/defender-for-iot/organizations/best-practices/understand-network-architecture':702 '/en-us/azure/defender-for-iot/organizations/billing':603 '/en-us/azure/defender-for-iot/organizations/cli-ot-sensor':1073 '/en-us/azure/defender-for-iot/organizations/compliance':887 '/en-us/azure/defender-for-iot/organizations/configure-active-monitoring':1085 '/en-us/azure/defender-for-iot/organizations/configure-reverse-dns-lookup':1096 '/en-us/azure/defender-for-iot/organizations/configure-sensor-settings-portal':1107 '/en-us/azure/defender-for-iot/organizations/configure-windows-endpoint-monitoring':1118 '/en-us/azure/defender-for-iot/organizations/connect-sensors':1128 '/en-us/azure/defender-for-iot/organizations/detect-windows-endpoints-script':1313 '/en-us/azure/defender-for-iot/organizations/eiot-defender-for-endpoint':898 '/en-us/azure/defender-for-iot/organizations/how-to-accelerate-alert-incident-response':566 '/en-us/azure/defender-for-iot/organizations/how-to-forward-alert-information-to-partners':1325 '/en-us/azure/defender-for-iot/organizations/how-to-import-device-information':1138 '/en-us/azure/defender-for-iot/organizations/how-to-manage-individual-sensors':1149 '/en-us/azure/defender-for-iot/organizations/how-to-manage-sensors-on-the-cloud':1160 '/en-us/azure/defender-for-iot/organizations/how-to-set-up-snmp-mib-monitoring':1172 '/en-us/azure/defender-for-iot/organizations/how-to-troubleshoot-sensor':496 '/en-us/azure/defender-for-iot/organizations/how-to-work-with-threat-intelligence-packages':1183 '/en-us/azure/defender-for-iot/organizations/integrate-overview':1336 '/en-us/azure/defender-for-iot/organizations/integrations/arcsight':1347 '/en-us/azure/defender-for-iot/organizations/integrations/logrhythm':1358 '/en-us/azure/defender-for-iot/organizations/integrations/netwitness':1369 '/en-us/azure/defender-for-iot/organizations/integrations/on-premises-sentinel':1383 '/en-us/azure/defender-for-iot/organizations/integrations/send-cloud-data-to-partners':1397 '/en-us/azure/defender-for-iot/organizations/integrations/service-now-legacy':1408 '/en-us/azure/defender-for-iot/organizations/iot-advanced-threat-monitoring':1420 '/en-us/azure/defender-for-iot/organizations/iot-solution':1433 '/en-us/azure/defender-for-iot/organizations/license-and-trial-license-extention':613 '/en-us/azure/defender-for-iot/organizations/manage-users-overview':908 '/en-us/azure/defender-for-iot/organizations/manage-users-portal':920 '/en-us/azure/defender-for-iot/organizations/manage-users-sensor':933 '/en-us/azure/defender-for-iot/organizations/monitor-zero-trust':947 '/en-us/azure/defender-for-iot/organizations/networking-requirements':737 '/en-us/azure/defender-for-iot/organizations/onboard-sensors':1195 '/en-us/azure/defender-for-iot/organizations/ot-appliance-sizing':624 '/en-us/azure/defender-for-iot/organizations/ot-deploy/activate-deploy-sensor':1207 '/en-us/azure/defender-for-iot/organizations/ot-deploy/air-gapped-deploy':1805 '/en-us/azure/defender-for-iot/organizations/ot-deploy/create-ssl-certificates':959 '/en-us/azure/defender-for-iot/organizations/ot-deploy/install-software-ot-sensor':1818 '/en-us/azure/defender-for-iot/organizations/ot-deploy/on-premises-management-console-retirement':637 '/en-us/azure/defender-for-iot/organizations/ot-deploy/post-install-validation-ot-software':507 '/en-us/azure/defender-for-iot/organizations/ot-deploy/provision-cloud-management':1218 '/en-us/azure/defender-for-iot/organizations/ot-deploy/transition-on-premises-management-console-to-cloud':651 '/en-us/azure/defender-for-iot/organizations/ot-pre-configured-appliances':747 '/en-us/azure/defender-for-iot/organizations/ot-virtual-appliances':757 '/en-us/azure/defender-for-iot/organizations/recommendations':972 '/en-us/azure/defender-for-iot/organizations/references-data-retention':767 '/en-us/azure/defender-for-iot/organizations/references-work-with-defender-for-iot-apis':1444 '/en-us/azure/defender-for-iot/organizations/release-notes':663 '/en-us/azure/defender-for-iot/organizations/release-notes-ot-monitoring-sensor-archive':778 '/en-us/azure/defender-for-iot/organizations/roles-azure':984 '/en-us/azure/defender-for-iot/organizations/roles-on-premises':996 '/en-us/azure/defender-for-iot/organizations/sensor-health-messages':517 '/en-us/azure/defender-for-iot/organizations/set-up-sso':1008 '/en-us/azure/defender-for-iot/organizations/track-user-activity':1229 '/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-erspan':1455 '/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-esxi':1467 '/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-hyper-v':1480 '/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-rspan':1490 '/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-span':1503 '/en-us/azure/defender-for-iot/organizations/traffic-mirroring/set-up-traffic-mirroring':1828 '/en-us/azure/defender-for-iot/organizations/tutorial-cyberark':1515 '/en-us/azure/defender-for-iot/organizations/tutorial-forescout':1527 '/en-us/azure/defender-for-iot/organizations/tutorial-fortinet':1537 '/en-us/azure/defender-for-iot/organizations/tutorial-palo-alto':1548 '/en-us/azure/defender-for-iot/organizations/tutorial-qradar':1559 '/en-us/azure/defender-for-iot/organizations/tutorial-servicenow':1570 '/en-us/azure/defender-for-iot/organizations/tutorial-splunk':1580 '/en-us/azure/defender-for-iot/organizations/update-ot-software':1839 '/en-us/azure/defender-for-iot/organizations/workbooks':1592 '/microsoftdocs/mcp/blob/main/readme.md)':170 '11':1657,1670,1735 '2':1751 '2lff':1671,1708 '3':141 '4sff':1658 'accept':209 'access':175,917,1281 'action':981 'activ':404,1076,1198,1226 'agent':90,134,193,207,227,389,426,471,785,829,1017,1029,1039,1048,1056,1238,1249 'air':1797 'air-gap':1796 'alert':243,267,359,482,557,790,800,822,830,854,1260,1297,1317,1343,1352,1366,1389,1556 'alto':1540 'api':424,864,1250,1265,1277,1289,1441 'appli':804,934 'applianc':286,345,460,617,744,754,1601,1645 'appropri':615 'architectur':20,59,302,310,664,670 'archiv':769 'arcsight':1338 'assign':850,909 'audit':375,403,838,1219 'auth':362 'authent':863 'autom':431,1293 'avail':160 'azur':2,9,38,49,315,676,910,974,1103,1125,1156,1192,1587 'azure-defender-for-iot':1 'back':450,1781 'behavior':1018 'benchmark':256,524 'best':16,55,245,250,518 'bill':289,598 'built':240,787,820 'built-in':786,819 'ca':950 'ca-sign':949 'call':858 'capabl':82 'catalog':739 'categori':93,101,117,213,215 'central':1101 'certif':364,870,884,953 'check':748 'choos':279,571,604,1326 'cis':255,523 'cisco':1446,1482,1492 'cli':1069 'cloud':292,648,1214,1388 'code':28,67,406,1231 'combin':72 'command':1070 'complianc':882 'compon':324 'configur':26,37,65,380,384,447,836,985,997,1009,1012,1033,1043,1053,1074,1086,1097,1119,1196,1208,1328,1398,1445,1481,1491,1809 'connect':312,317,672,684,1123,1370,1421 'connector':1430 'consol':290,633,1005,1145 'content':77,179 'correct':1823 'cover':53 'creat':848,948 'credenti':1511 'custom':795,851 'cyberark':1505 'data':335,711,762,1133,1284,1307,1429,1585 'decid':583 'decis':18,57,272,567 'decod':1035 'defend':3,10,39,50,223,296,321,351,366,385,412,455,467,478,489,498,509,527,536,549,560,577,595,607,619,627,639,653,692,708,718,732,759,770,783,796,805,815,840,852,859,879,893,900,914,927,942,961,978,989,1013,1027,1037,1044,1054,1064,1080,1151,1188,1200,1222,1236,1247,1262,1274,1286,1329,1340,1349,1363,1374,1385,1403,1414,1422,1437,1449,1496,1507,1519,1532,1543,1553,1565,1575,1582,1603,1716,1727,1740,1756,1785,1799,1810,1830 'defin':794 'dell':1610,1621,1632 'depend':395,1025 'deploy':31,34,70,433,446,1593,1609,1620,1631,1642,1715,1726,1739,1755,1768,1802,1819 'descript':217 'design':21,60,257,303,665 'develop':13 'devic':853,1092,1132 'disconnect':1296 'dl20':1655,1668,1682,1693,1705 'dl360':1722,1733 'dmi':1034 'dns':1088 'doc':185 'document':80,178 'dps':1240 'e.g':105,121 'eclips':1058,1252 'enabl':888 'endpoint':895,1111,1210,1306 'enrich':1093,1304 'enterpris':889,1684,1697 'entra':1000 'erspan':587,1447 'esxi':1457,1764 'event':844 'expert':6,46 'extend':606 'fallback':197 'featur':339,721 'fetch':81,177,186,199 'file':111,119,126,131 'firewal':417,1209,1530,1541 'fit2':1774 'forescout':1517 'fortinet':1529 'forward':1314,1344 'gap':1798 'gen':1656,1669,1734,1750 'gen10':1694,1706 'github.com':169 'github.com/microsoftdocs/mcp/blob/main/readme.md)':168 'gui':1146 'guid':167,444 'guidanc':47,277 'hardware/vm':437 'health':236,513,1165 'heptagon':1643 'hpe':1653,1666,1680,1691,1703,1720,1731 'hub':799,808,818 'hub/ot':369 'hybrid':1794 'hyper':1470,1748 'hyper-v':1469,1747 'ibm':1550 'id':1001 'import':88,132,1129 'includ':14,371 'index':94,214 'initi':1808 'instal':164,166,233,504,1806 'integr':27,66,405,411,1230,1333,1337,1359,1401,1434,1504,1516,1528,1538,1549,1560,1571 'intellig':1175 'interpret':234,508 'inventori':1272 'investig':522,1413 'iot':5,12,41,52,225,298,323,353,387,414,457,469,480,491,500,511,538,551,562,579,597,609,621,629,641,655,694,710,720,734,761,772,798,807,817,861,881,890,902,916,929,944,963,980,991,1003,1015,1046,1066,1082,1153,1190,1202,1224,1264,1276,1288,1331,1342,1351,1365,1376,1387,1405,1416,1424,1439,1451,1498,1509,1521,1534,1545,1555,1567,1577,1584,1605,1718,1729,1742,1758,1787,1801,1812,1832 'iot/iot':368 'issu':472 'knowledg':7 'l107':357 'l108':382 'l108-l131':381 'l120':108 'l131':383 'l132':409 'l132-l166':408 'l166':410 'l167':435 'l167-l189':434 'l189':436 'l35':107 'l35-l120':106 'l37':220 'l37-l45':219 'l45':221 'l46':248 'l46-l53':247 'l53':249 'l54':275 'l54-l65':274 'l65':276 'l66':306 'l66-l72':305 'l72':307 'l73':333 'l73-l83':332 'l83':334 'l84':356 'l84-l107':355 'latest':149 'layer':329,699 'learn':192,206 'learn-agent-skil':191,205 'learn.microsoft.com':474,485,495,506,516,529,540,553,565,581,592,602,612,623,636,650,662,678,689,701,715,725,736,746,756,766,777,792,802,812,824,834,846,856,866,876,886,897,907,919,932,946,958,971,983,995,1007,1020,1031,1041,1051,1061,1072,1084,1095,1106,1117,1127,1137,1148,1159,1171,1182,1194,1206,1217,1228,1244,1255,1267,1279,1291,1302,1312,1324,1335,1346,1357,1368,1382,1396,1407,1419,1432,1443,1454,1466,1479,1489,1502,1514,1526,1536,1547,1558,1569,1579,1591,1607,1618,1629,1640,1650,1663,1676,1688,1700,1713,1724,1737,1753,1766,1779,1791,1804,1817,1827,1838 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-agent-based-security-alerts':791 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-customizable-security-alerts':801 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-data-processing':714 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-micro-agent-configuration':1019 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-micro-agent-linux-dependencies':1030 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-recommendations':811 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-security-alerts':823 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-threadx-security-alerts-recommendations':833 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/configure-pam-to-audit-sign-in-events':845 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/edge-security-module-deprecation':724 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-configure-dmi-decoder':1040 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-configure-micro-agent-twin':1050 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-investigate-cis-benchmark':528 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-provision-micro-agent':1243 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-threadx-security-module':1060 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/quickstart-create-custom-alerts':855 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/threadx-security-module-api':1254 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/troubleshoot-defender-micro-agent':473 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/alert-engine-messages':484 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-alert-apis':1266 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-auth-apis':865 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-inventory-apis':1278 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-vulnerability-apis':1290 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/':1606 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r350-e1800':1617 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r360-e1800':1628 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r660':1639 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/heptagon-yb3x':1649 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-gen-11':1662 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-gen-11-nhp-2lff':1675 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-legacy':1687 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-plus-enterprise':1699 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-plus-smb':1712 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl360':1723 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl360-gen11':1736 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/virtual-sensor-hyper-v':1752 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/virtual-sensor-vmware':1765 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/ys-techsystems-ys-fit2':1778 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/architecture-connections':677 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/automate-sensor-disconnection-alerts':1301 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/back-up-restore-sensor':1790 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/certificate-requirements':875 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/plan-corporate-monitoring':539 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/plan-prepare-deploy':552 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/sample-connectivity-models':688 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/traffic-mirroring-methods':580,591 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/understand-network-architecture':700 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/billing':601 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/cli-ot-sensor':1071 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/compliance':885 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/configure-active-monitoring':1083 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/configure-reverse-dns-lookup':1094 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/configure-sensor-settings-portal':1105 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/configure-windows-endpoint-monitoring':1116 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/connect-sensors':1126 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/detect-windows-endpoints-script':1311 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/eiot-defender-for-endpoint':896 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-accelerate-alert-incident-response':564 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-forward-alert-information-to-partners':1323 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-import-device-information':1136 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-manage-individual-sensors':1147 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-manage-sensors-on-the-cloud':1158 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-set-up-snmp-mib-monitoring':1170 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-troubleshoot-sensor':494 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-work-with-threat-intelligence-packages':1181 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrate-overview':1334 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/arcsight':1345 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/logrhythm':1356 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/netwitness':1367 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/on-premises-sentinel':1381 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/send-cloud-data-to-partners':1395 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/service-now-legacy':1406 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/iot-advanced-threat-monitoring':1418 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/iot-solution':1431 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/license-and-trial-license-extention':611 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/manage-users-overview':906 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/manage-users-portal':918 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/manage-users-sensor':931 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/monitor-zero-trust':945 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/networking-requirements':735 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/onboard-sensors':1193 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-appliance-sizing':622 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/activate-deploy-sensor':1205 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/air-gapped-deploy':1803 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/create-ssl-certificates':957 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/install-software-ot-sensor':1816 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/on-premises-management-console-retirement':635 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/post-install-validation-ot-software':505 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/provision-cloud-management':1216 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/transition-on-premises-management-console-to-cloud':649 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-pre-configured-appliances':745 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-virtual-appliances':755 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/recommendations':970 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/references-data-retention':765 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/references-work-with-defender-for-iot-apis':1442 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/release-notes':661 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/release-notes-ot-monitoring-sensor-archive':776 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/roles-azure':982 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/roles-on-premises':994 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/sensor-health-messages':515 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/set-up-sso':1006 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/track-user-activity':1227 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-erspan':1453 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-esxi':1465 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-hyper-v':1478 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-rspan':1488 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-span':1501 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/set-up-traffic-mirroring':1826 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-cyberark':1513 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-forescout':1525 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-fortinet':1535 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-palo-alto':1546 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-qradar':1557 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-servicenow':1568 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-splunk':1578 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/update-ot-software':1837 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/workbooks':1590 'legaci':1380,1399,1679 'licens':284,600,610 'lifecycl':340,723 'limit':23,62,330,338,703,764 'line':103,115,216 'link':120,129 'linux':1023 'local':73,1309 'locat':97 'logrhythm':1354 'lookup':1089 'mainten':401,1142 'make':19,58,273,568 'manag':400,642,899,921,1150,1173,1215,1257,1269,1563 'map':320,691,713,973 'markdown':196,212 'mcp':155,182 'meet':868 'messag':237,514 'metadata.generated':136 'method':283,575,1078 'mib':1164 'micro':226,388,425,470,784,828,1016,1028,1038,1047,1055,1237,1248 'microsoft':184,488,1199,1426,1436,1574 'microsoftdoc':156,183 'mirror':282,429,448,574,590,1464,1477,1484,1500,1825 'mode':397,1460,1474 'model':318,685 'monitor':258,379,396,533,743,937,1077,1112,1166,1487,1588,1600,1616,1627,1638,1648,1661,1674,1686,1777 'month':142 'netwit':1361 'network':174,309,328,683,698,727,940,1115 'networking/port':348 'networking/proxy/dns/firewall':398 'old':143 'on-premis':630,644,922,986,1371 'onboard':1184 'optim':266,555 'os':394,1024 'ot':35,229,280,299,308,327,342,391,458,492,501,532,543,556,572,589,616,656,673,682,697,742,753,773,873,939,955,968,1067,1075,1091,1098,1114,1120,1131,1140,1168,1179,1185,1203,1212,1258,1270,1282,1294,1315,1462,1476,1486,1523,1562,1599,1614,1625,1636,1647,1660,1673,1685,1698,1711,1743,1759,1776,1788,1813,1820,1833 'ot/ics':253 'packag':1176 'palo':1539 'pam':374,837 'parti':1393 'partner':421,1319,1332 'pattern':22,29,61,68,304,407,432,666,1232 'perform':1139 'placement':262,547 'plan':260,288,531,594,625,1793 'playbook':1300 'plus':287,423,1695,1707 'port':730,1494 'portal':1104,1157 'poweredg':1611,1622,1633 'practic':17,56,246,251,519 'preconfigur':741 'prefer':180 'premis':632,646,924,988,1373 'prepar':542 'prerequisit':349 'proliant':1654,1667,1681,1692,1704,1721,1732 'promiscu':1459,1473 'provid':45 'provis':427,1235 'proxi':1122 'pull':147 'purdu':326,696 'qradar':1551 'queri':188,202 'quick':75 'quick-refer':74 'quota':24,63,331,704 'r350':1612 'r360':1623 'r660':1634 'rang':104 'rbac':372,911,975 'read':110,125 'recommend':360,525,810,832,965 'reduc':967 'refer':76,130,476 'relev':98 'remot':79 'repositori':153 'requir':173,346,438,728,750,871 'resid':336,712 'respons':270 'rest':1440 'restor':452,1784 'retent':337,763 'retir':291,634 'return':195,211 'revers':1087 'review':717,738,768,878,1022 'risk':969 'role':361,905,912,976,993 'rsa':1360 'rspan':586,1483 'sampl':316,681 'script':1310 'section':99 'secur':25,64,354,358,779,789,809,891,964,1512 'security.md':122,123 'select':614,669,1596 'send':1348 'sensor':36,230,232,235,242,261,313,343,370,392,399,459,481,493,502,512,546,563,674,687,774,862,874,930,956,1004,1068,1099,1121,1135,1141,1144,1154,1169,1180,1186,1204,1213,1259,1271,1295,1316,1377,1452,1615,1626,1637,1744,1760,1789,1814,1821,1834 'sentinel':419,1299,1379,1410,1427 'servicenow':418,1400,1561 'set':1100,1108,1161 'setup':393 'siem':416,1355,1394 'sign':842,951 'sign-in':841 'site':264,544 'skill':42,44,87,172,194,208 'skill-azure-defender-for-iot' 'smb':1710 'snmp':1163 'softwar':300,503,657,1815,1835 'solut':1411 'source-microsoftdocs' 'span':585,1493 'specifi':114 'splunk':1572 'ssl/tls':869,952 'sso':373,998 'step':441,443 'step-by-step':440 'stream':1384 'string':189,203 'suggest':144,161 'supplement':1130 'support':660,722 'supported/archived':341 'syslog':1322 'system':749,1320 'techsystem':1771 'text/markdown':210 'third':1392 'third-parti':1391 'threadx':827,1059,1253 'threat':1174,1417 'tool':157,422 'topic':464,520,569,667,705,780,1010,1233,1594 'topic-agent' 'topic-agent-skills' 'topic-agentic-skills' 'topic-agentskill' 'topic-ai-agents' 'topic-ai-coding' 'topic-azure' 'topic-azure-functions' 'topic-azure-kubernetes-service' 'topic-azure-openai' 'topic-azure-sql-database' 'topic-azure-storage' 'topolog':259,534 'track':295,652,1221 'traffic':281,428,449,573,1463,1499,1824 'transit':293,638 'triag':268 'troubleshoot':15,54,218,222,463,466,487 'trust':378,936 'twin':1049 'type':244,483 'understand':239,707,758 'updat':454,1177,1829 'url':465,521,570,668,706,781,1011,1234,1595 'use':32,85,91,109,124,181,198,254,680,782,814,826,960,1063,1246,1261,1308,1409,1456,1468,1598,1652,1665,1678,1690,1702 'user':146,163,903,925,992,1225 'v':1471,1749 'valid':231,497 'version':150,301,658,775,1836 'via':1143,1273,1285,1428 'virtual':344,752 'visibl':1524 'visual':1581 'vm':1745,1761 'vms':462 'vmware':1763 'vswitch':1458,1472 'vulner':1283 'webpag':200 'window':1110,1305 'workbook':1589 'workflow':271,558 'x.509':1242 'yb3x':1644 'ys':1770,1773 'ys-fit2':1772 'ys-techsystem':1769 'zero':377,935","prices":[{"id":"bc71dbad-4746-4401-8d79-84d251bfafe7","listingId":"5c427fe2-e8b6-4e83-941a-5b48030f2e64","amountUsd":"0","unit":"free","nativeCurrency":null,"nativeAmount":null,"chain":null,"payTo":null,"paymentMethod":"skill-free","isPrimary":true,"details":{"org":"MicrosoftDocs","category":"Agent-Skills","install_from":"skills.sh"},"createdAt":"2026-04-18T21:58:51.461Z"}],"sources":[{"listingId":"5c427fe2-e8b6-4e83-941a-5b48030f2e64","source":"github","sourceId":"MicrosoftDocs/Agent-Skills/azure-defender-for-iot","sourceUrl":"https://github.com/MicrosoftDocs/Agent-Skills/tree/main/skills/azure-defender-for-iot","isPrimary":false,"firstSeenAt":"2026-04-18T21:58:51.461Z","lastSeenAt":"2026-05-18T18:53:52.317Z"}],"details":{"listingId":"5c427fe2-e8b6-4e83-941a-5b48030f2e64","quickStartSnippet":null,"exampleRequest":null,"exampleResponse":null,"schema":null,"openapiUrl":null,"agentsTxtUrl":null,"citations":[],"useCases":[],"bestFor":[],"notFor":[],"kindDetails":{"org":"MicrosoftDocs","slug":"azure-defender-for-iot","github":{"repo":"MicrosoftDocs/Agent-Skills","stars":549,"topics":["agent","agent-skills","agentic-skills","agentskill","ai","ai-agents","ai-coding","azure","azure-functions","azure-kubernetes-service","azure-openai","azure-sql-database","azure-storage","azure-virtual-machine","claude-code","github-copilot","microsoft-learn","openai-codex","skills"],"license":"cc-by-4.0","html_url":"https://github.com/MicrosoftDocs/Agent-Skills","pushed_at":"2026-05-17T02:50:05Z","description":"Curated Agent Skills for Microsoft & Azure – giving AI coding assistants structured, real-time expertise from Microsoft Learn docs.","skill_md_sha":"5d9037213f0bd85e9f602b9aea2cd9a327e212c1","skill_md_path":"skills/azure-defender-for-iot/SKILL.md","default_branch":"main","skill_tree_url":"https://github.com/MicrosoftDocs/Agent-Skills/tree/main/skills/azure-defender-for-iot"},"layout":"multi","source":"github","category":"Agent-Skills","frontmatter":{"name":"azure-defender-for-iot","description":"Expert knowledge for Azure Defender For Iot development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when deploying OT sensors, configuring micro agents, mirroring OT traffic, integrating with SIEM/Sentinel, or tuning alerts, and other Azure Defender For Iot related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure IoT (use azure-iot), Azure IoT Hub (use azure-iot-hub), Azure Security (use azure-security).","compatibility":"Requires network access. Uses mcp_microsoftdocs:microsoft_docs_fetch or fetch_webpage to retrieve documentation."},"skills_sh_url":"https://skills.sh/MicrosoftDocs/Agent-Skills/azure-defender-for-iot"},"updatedAt":"2026-05-18T18:53:52.317Z"}}