{"id":"5c427fe2-e8b6-4e83-941a-5b48030f2e64","shortId":"wZpDhd","kind":"skill","title":"azure-defender-for-iot","tagline":"Expert knowledge for Azure Defender For Iot development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when deploying OT sensors, configuring","description":"# Azure Defender For Iot Skill\n\nThis skill provides expert guidance for Azure Defender For Iot. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.\n\n## How to Use This Skill\n\n> **IMPORTANT for Agent**: Use the **Category Index** below to locate relevant sections. For categories with line ranges (e.g., `L35-L120`), use `read_file` with the specified lines. For categories with file links (e.g., `[security.md](security.md)`), use `read_file` on the linked reference file\n\n> **IMPORTANT for Agent**: If `metadata.generated_at` is more than 3 months old, suggest the user pull the latest version from the repository. If `mcp_microsoftdocs` tools are not available, suggest the user install it: [Installation Guide](https://github.com/MicrosoftDocs/mcp/blob/main/README.md)\n\nThis skill requires **network access** to fetch documentation content:\n- **Preferred**: Use `mcp_microsoftdocs:microsoft_docs_fetch` with query string `from=learn-agent-skill`. Returns Markdown.\n- **Fallback**: Use `fetch_webpage` with query string `from=learn-agent-skill&accept=text/markdown`. Returns Markdown.\n\n## Category Index\n\n| Category | Lines | Description |\n|----------|-------|-------------|\n| Troubleshooting | L37-L48 | Diagnosing and fixing Defender for IoT micro agent and OT sensor issues, understanding/handling security and health alerts, and validating sensor/agent installation and configuration. |\n| Best Practices | L49-L56 | Best practices for securing IoT/OT with Defender for IoT: using hub security recommendations, CIS benchmark guidance, and planning OT monitoring topology and sensor placement. |\n| Decision Making | L57-L68 | Guidance on planning Defender for IoT deployments: choosing OT traffic mirroring, appliances, licenses, partner integrations, billing, hybrid/air-gapped setups, and on-premises to cloud transitions. |\n| Architecture & Design Patterns | L69-L75 | Architectural guidance for connecting OT/ICS sensors to Azure, using sample OT network topologies, and aligning Defender for IoT deployment with Purdue model layers. |\n| Limits & Quotas | L76-L84 | Info on OT trial setup, supported/retiring features, appliance catalog and requirements, and Defender for IoT data retention and storage limits. |\n| Security | L85-L103 | Securing Defender for IoT OT environments: auth, RBAC/roles, SSO, certificates, Zero Trust, alert workflows/response, and auditing user and programming activity. |\n| Configuration | L104-L135 | Configuring Defender for IoT agents/sensors: micro agent twins, dependencies, alerts, OT sensor settings, traffic mirroring, connectivity, monitoring methods, and threat intel updates. |\n| Integrations & Coding Patterns | L136-L163 | Integrating Defender for IoT with SIEMs, firewalls, ServiceNow, Sentinel, OT sensors, and micro agents, plus using APIs, playbooks, and workbooks to automate alerts and manage inventory/vulnerabilities. |\n| Deployment | L164-L187 | Planning and deploying Defender for IoT OT sensors: hardware/VM options, appliance-specific guides, traffic mirroring, onboarding, activation, and moving IoT security resources across regions. |\n\n### Troubleshooting\n| Topic | URL |\n|-------|-----|\n| Use Defender micro agent security alerts and remediation guidance | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-agent-based-security-alerts |\n| Use Defender for IoT Hub built-in and custom alerts | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-security-alerts |\n| Use ThreadX Defender micro agent alerts and recommendations | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-threadx-security-alerts-recommendations |\n| Troubleshoot Microsoft Defender for IoT micro agent issues | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/troubleshoot-defender-micro-agent |\n| Investigate and remediate Defender for IoT security alerts | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/tutorial-investigate-security-alerts |\n| Troubleshoot Microsoft Defender for IoT OT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-troubleshoot-sensor |\n| Validate Defender for IoT OT sensor installation health | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/post-install-validation-ot-software |\n| Interpret Defender for IoT sensor health messages | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/sensor-health-messages |\n\n### Best Practices\n| Topic | URL |\n|-------|-----|\n| Apply Defender for IoT Hub security recommendations | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-recommendations |\n| Investigate CIS benchmark-based Defender recommendations | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-investigate-cis-benchmark |\n| Plan OT monitoring topology with Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/plan-corporate-monitoring |\n| Prepare OT sites and sensor placement for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/plan-prepare-deploy |\n\n### Decision Making\n| Topic | URL |\n|-------|-----|\n| Choose OT traffic mirroring methods for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/traffic-mirroring-methods |\n| Decide on OT traffic mirroring methods for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/traffic-mirroring-methods |\n| Plan Defender for IoT billing and licensing | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/billing |\n| Choose and plan Defender for IoT partner integrations | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrate-overview |\n| Choose and extend Defender for IoT licenses | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/license-and-trial-license-extention |\n| Select appropriate OT appliances for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-appliance-sizing |\n| Plan hybrid or air-gapped Defender for IoT deployments | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/air-gapped-deploy |\n| Transition Defender for IoT from on-premises to cloud | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/transition-on-premises-management-console-to-cloud |\n\n### Architecture & Design Patterns\n| Topic | URL |\n|-------|-----|\n| Select architectures to connect OT sensors to Azure | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/architecture-connections |\n| Use sample OT network connectivity models for sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/sample-connectivity-models |\n| Map Defender for IoT to Purdue OT architecture | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/understand-network-architecture |\n\n### Limits & Quotas\n| Topic | URL |\n|-------|-----|\n| Understand Defender for IoT feature support and retirement timelines | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/edge-security-module-deprecation |\n| Set up Defender for IoT OT trial plan | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/getting-started |\n| Review catalog of preconfigured OT monitoring appliances | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-pre-configured-appliances |\n| System requirements for Defender for IoT OT virtual appliances | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-virtual-appliances |\n| Understand Defender for IoT data retention limits | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/references-data-retention |\n\n### Security\n| Topic | URL |\n|-------|-----|\n| Manage OT sensor authentication via Defender for IoT APIs | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-auth-apis |\n| Meet SSL/TLS certificate requirements for OT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/certificate-requirements |\n| Analyze OT programming events for suspicious changes | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-analyze-programming-details-changes |\n| Manage Defender for IoT alerts in Azure portal | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-manage-cloud-alerts |\n| View and manage OT sensor alerts locally | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-view-alerts |\n| Assign Azure RBAC roles for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/manage-users-portal |\n| Manage on-premises users on OT network sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/manage-users-sensor |\n| Apply Zero Trust monitoring to OT networks | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/monitor-zero-trust |\n| Create CA-signed SSL/TLS certificates for OT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/create-ssl-certificates |\n| Use Defender for IoT security recommendations to reduce risk | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/recommendations |\n| Investigate and respond to OT alerts in Azure | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/respond-ot-alert |\n| Map Azure RBAC roles for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/roles-azure |\n| Configure on-premises roles for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/roles-on-premises |\n| Configure SSO for Defender for IoT sensor console | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/set-up-sso |\n| Audit user activity in Microsoft Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/track-user-activity |\n\n### Configuration\n| Topic | URL |\n|-------|-----|\n| Configure custom security alerts for Azure IoT Hub | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-customizable-security-alerts |\n| Configure Defender for IoT micro agent behavior via module twin | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-micro-agent-configuration |\n| Meet Linux dependency requirements for Defender micro agent | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-micro-agent-linux-dependencies |\n| Configure PAM on Linux to audit sign-in events for Defender | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/configure-pam-to-audit-sign-in-events |\n| Configure DMI decoder and alternatives for Defender micro agent | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-configure-dmi-decoder |\n| Configure Defender for IoT micro agent twin properties | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-configure-micro-agent-twin |\n| Configure Defender micro agent for Eclipse ThreadX devices | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-threadx-security-module |\n| Create and assign custom Defender for IoT device alerts | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/quickstart-create-custom-alerts |\n| Configure Microsoft Defender for IoT agent-based solution | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/tutorial-configure-agent-based-solution |\n| Create Defender for IoT micro agent module twin | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/tutorial-create-micro-agent-module-twin |\n| Use Defender for IoT OT sensor CLI commands | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/cli-ot-sensor |\n| Configure active monitoring methods for OT networks | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/configure-active-monitoring |\n| Set up reverse DNS lookup for OT active monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/configure-reverse-dns-lookup |\n| Configure OT sensor settings centrally from Azure portal | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/configure-sensor-settings-portal |\n| Configure Windows Endpoint Monitoring for OT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/configure-windows-endpoint-monitoring |\n| Configure OT sensor proxy connectivity to Azure | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/connect-sensors |\n| Use local script to enrich Windows endpoint data | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/detect-windows-endpoints-script |\n| Import supplemental OT device data into sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-import-device-information |\n| Maintain individual OT sensors via sensor console | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-manage-individual-sensors |\n| Configure SNMP MIB monitoring for OT sensor health | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-set-up-snmp-mib-monitoring |\n| Manage threat intelligence package updates on OT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-work-with-threat-intelligence-packages |\n| Apply networking requirements for Defender for IoT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/networking-requirements |\n| Allow OT sensor connectivity to Azure endpoints | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/provision-cloud-management |\n| Configure ERSPAN on Cisco for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-erspan |\n| Configure ESXi vSwitch promiscuous mode for mirroring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-esxi |\n| Configure Hyper-V vSwitch promiscuous mode for mirroring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-hyper-v |\n| Configure Cisco RSPAN mirroring for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-rspan |\n| Configure Cisco SPAN port mirroring for OT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-span |\n\n### Integrations & Coding Patterns\n| Topic | URL |\n|-------|-----|\n| Provision Defender micro agent using IoT Hub DPS with X.509 | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-provision-micro-agent |\n| Use Defender micro agent API for Eclipse ThreadX integration | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/threadx-security-module-api |\n| Integrate OT sensor alert management APIs | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-alert-apis |\n| Integrate OT sensor inventory management APIs | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-inventory-apis |\n| Use OT sensor vulnerability management APIs | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-vulnerability-apis |\n| Automate sensor disconnection alerts with Sentinel playbooks | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/automate-sensor-disconnection-alerts |\n| Forward OT sensor alerts to partner systems | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-forward-alert-information-to-partners |\n| Integrate Defender for IoT with ArcSight SIEM | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/arcsight |\n| Send Defender for IoT alerts to LogRhythm | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/logrhythm |\n| Send Defender for IoT alerts to RSA NetWitness | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/netwitness |\n| Connect on-premises Defender for IoT to Sentinel (legacy) | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/on-premises-sentinel |\n| Stream Defender for IoT cloud alerts to external SIEMs | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/send-cloud-data-to-partners |\n| Configure legacy ServiceNow integration for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/service-now-legacy |\n| Use Sentinel solution to detect IoT threats | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/iot-advanced-threat-monitoring |\n| Connect Defender for IoT with Microsoft Sentinel | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/iot-solution |\n| Access Defender for IoT data via REST APIs | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/references-work-with-defender-for-iot-apis |\n| Integrate CyberArk with Defender for IoT for credential security | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-cyberark |\n| Integrate Forescout with Microsoft Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-forescout |\n| Integrate Fortinet firewalls with Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-fortinet |\n| Integrate Palo Alto firewalls with Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-palo-alto |\n| Integrate IBM QRadar with Defender for IoT alerts | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-qradar |\n| Integrate ServiceNow Operational Technology Manager with Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-servicenow |\n| Integrate Splunk with Microsoft Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-splunk |\n| Visualize Defender for IoT data with Azure workbooks | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/workbooks |\n\n### Deployment\n| Topic | URL |\n|-------|-----|\n| Move Defender for IoT iotsecuritysolutions resource across regions | https://learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-region-move |\n| Select OT monitoring appliances for Defender for IoT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/ |\n| Use Dell PowerEdge R350 for OT sensor deployments | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r350-e1800 |\n| Use Dell PowerEdge R360 for OT sensor deployments | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r360-e1800 |\n| Use Dell PowerEdge R660 for OT sensor deployments | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r660 |\n| Deploy Heptagon YB3x appliance for OT monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/heptagon-yb3x |\n| Use HPE DL20 Gen 11 (4SFF) for SMB OT monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-gen-11 |\n| Use HPE DL20 Gen 11 (NHP 2LFF) for SMB/L500 OT monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-gen-11-nhp-2lff |\n| Use legacy HPE DL20 Gen10 for enterprise OT monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-legacy |\n| Use HPE DL20 Gen10 Plus for enterprise OT monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-plus-enterprise |\n| Use HPE DL20 Gen10 Plus (NHP 2LFF) for SMB/L500 OT | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-plus-smb |\n| Deploy Defender for IoT on HPE ProLiant DL360 | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl360 |\n| Deploy Defender for IoT on HPE ProLiant DL360 Gen 11 | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl360-gen11 |\n| Deploy OT sensor as Hyper-V Gen 2 virtual appliance | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/virtual-sensor-hyper-v |\n| Deploy OT sensor as VMware ESXi virtual appliance | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/virtual-sensor-vmware |\n| Deploy YS-techsystems YS-FIT2 for OT monitoring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/ys-techsystems-ys-fit2 |\n| Onboard OT sensors to Defender for IoT in Azure | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/onboard-sensors |\n| Configure and activate Defender for IoT OT sensors | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/activate-deploy-sensor |\n| Install and initially configure OT sensor software | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/install-software-ot-sensor |\n| Understand Defender for IoT OT deployment phases | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/ot-deploy-path |\n| Deploy OT sensor with correct traffic mirroring | https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/set-up-traffic-mirroring |","tags":["azure","defender","for","iot","agent","skills","microsoftdocs","agent-skills","agentic-skills","agentskill","ai-agents","ai-coding"],"capabilities":["skill","source-microsoftdocs","skill-azure-defender-for-iot","topic-agent","topic-agent-skills","topic-agentic-skills","topic-agentskill","topic-ai-agents","topic-ai-coding","topic-azure","topic-azure-functions","topic-azure-kubernetes-service","topic-azure-openai","topic-azure-sql-database","topic-azure-storage"],"categories":["Agent-Skills"],"synonyms":[],"warnings":[],"endpointUrl":"https://skills.sh/MicrosoftDocs/Agent-Skills/azure-defender-for-iot","protocol":"skill","transport":"skills-sh","auth":{"type":"none","details":{"cli":"npx skills add MicrosoftDocs/Agent-Skills","source_repo":"https://github.com/MicrosoftDocs/Agent-Skills","install_from":"skills.sh"}},"qualityScore":"0.698","qualityRationale":"deterministic score 0.70 from registry signals: · indexed on github topic:agent-skills · 497 github stars · SKILL.md body (22,477 chars)","verified":false,"liveness":"unknown","lastLivenessCheck":null,"agentReviews":{"count":0,"score_avg":null,"cost_usd_avg":null,"success_rate":null,"latency_p50_ms":null,"narrative_summary":null,"summary_updated_at":null},"enrichmentModel":"deterministic:skill-github:v1","enrichmentVersion":1,"enrichedAt":"2026-04-22T06:53:31.443Z","embedding":null,"createdAt":"2026-04-18T21:58:51.461Z","updatedAt":"2026-04-22T06:53:31.443Z","lastSeenAt":"2026-04-22T06:53:31.443Z","tsv":"'/en-us/azure/defender-for-iot/device-builders/concept-agent-based-security-alerts':483 '/en-us/azure/defender-for-iot/device-builders/concept-customizable-security-alerts':986 '/en-us/azure/defender-for-iot/device-builders/concept-micro-agent-configuration':999 '/en-us/azure/defender-for-iot/device-builders/concept-micro-agent-linux-dependencies':1010 '/en-us/azure/defender-for-iot/device-builders/concept-recommendations':575 '/en-us/azure/defender-for-iot/device-builders/concept-security-alerts':497 '/en-us/azure/defender-for-iot/device-builders/concept-threadx-security-alerts-recommendations':508 '/en-us/azure/defender-for-iot/device-builders/configure-pam-to-audit-sign-in-events':1025 '/en-us/azure/defender-for-iot/device-builders/edge-security-module-deprecation':760 '/en-us/azure/defender-for-iot/device-builders/how-to-configure-dmi-decoder':1037 '/en-us/azure/defender-for-iot/device-builders/how-to-configure-micro-agent-twin':1048 '/en-us/azure/defender-for-iot/device-builders/how-to-investigate-cis-benchmark':585 '/en-us/azure/defender-for-iot/device-builders/how-to-provision-micro-agent':1305 '/en-us/azure/defender-for-iot/device-builders/how-to-region-move':1563 '/en-us/azure/defender-for-iot/device-builders/how-to-threadx-security-module':1059 '/en-us/azure/defender-for-iot/device-builders/quickstart-create-custom-alerts':1071 '/en-us/azure/defender-for-iot/device-builders/threadx-security-module-api':1317 '/en-us/azure/defender-for-iot/device-builders/troubleshoot-defender-micro-agent':519 '/en-us/azure/defender-for-iot/device-builders/tutorial-configure-agent-based-solution':1083 '/en-us/azure/defender-for-iot/device-builders/tutorial-create-micro-agent-module-twin':1094 '/en-us/azure/defender-for-iot/device-builders/tutorial-investigate-security-alerts':530 '/en-us/azure/defender-for-iot/organizations/api/sensor-alert-apis':1326 '/en-us/azure/defender-for-iot/organizations/api/sensor-auth-apis':818 '/en-us/azure/defender-for-iot/organizations/api/sensor-inventory-apis':1335 '/en-us/azure/defender-for-iot/organizations/api/sensor-vulnerability-apis':1344 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/':1574 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r350-e1800':1585 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r360-e1800':1596 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r660':1607 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/heptagon-yb3x':1617 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-gen-11':1630 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-gen-11-nhp-2lff':1644 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-legacy':1656 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-plus-enterprise':1668 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-plus-smb':1681 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl360':1692 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl360-gen11':1705 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/virtual-sensor-hyper-v':1719 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/virtual-sensor-vmware':1730 '/en-us/azure/defender-for-iot/organizations/appliance-catalog/ys-techsystems-ys-fit2':1743 '/en-us/azure/defender-for-iot/organizations/architecture-connections':722 '/en-us/azure/defender-for-iot/organizations/automate-sensor-disconnection-alerts':1354 '/en-us/azure/defender-for-iot/organizations/best-practices/certificate-requirements':828 '/en-us/azure/defender-for-iot/organizations/best-practices/plan-corporate-monitoring':596 '/en-us/azure/defender-for-iot/organizations/best-practices/plan-prepare-deploy':609 '/en-us/azure/defender-for-iot/organizations/best-practices/sample-connectivity-models':733 '/en-us/azure/defender-for-iot/organizations/best-practices/traffic-mirroring-methods':625,638 '/en-us/azure/defender-for-iot/organizations/best-practices/understand-network-architecture':744 '/en-us/azure/defender-for-iot/organizations/billing':648 '/en-us/azure/defender-for-iot/organizations/cli-ot-sensor':1105 '/en-us/azure/defender-for-iot/organizations/configure-active-monitoring':1115 '/en-us/azure/defender-for-iot/organizations/configure-reverse-dns-lookup':1127 '/en-us/azure/defender-for-iot/organizations/configure-sensor-settings-portal':1138 '/en-us/azure/defender-for-iot/organizations/configure-windows-endpoint-monitoring':1148 '/en-us/azure/defender-for-iot/organizations/connect-sensors':1158 '/en-us/azure/defender-for-iot/organizations/detect-windows-endpoints-script':1169 '/en-us/azure/defender-for-iot/organizations/getting-started':771 '/en-us/azure/defender-for-iot/organizations/how-to-analyze-programming-details-changes':838 '/en-us/azure/defender-for-iot/organizations/how-to-forward-alert-information-to-partners':1364 '/en-us/azure/defender-for-iot/organizations/how-to-import-device-information':1179 '/en-us/azure/defender-for-iot/organizations/how-to-manage-cloud-alerts':849 '/en-us/azure/defender-for-iot/organizations/how-to-manage-individual-sensors':1189 '/en-us/azure/defender-for-iot/organizations/how-to-set-up-snmp-mib-monitoring':1200 '/en-us/azure/defender-for-iot/organizations/how-to-troubleshoot-sensor':540 '/en-us/azure/defender-for-iot/organizations/how-to-view-alerts':859 '/en-us/azure/defender-for-iot/organizations/how-to-work-with-threat-intelligence-packages':1211 '/en-us/azure/defender-for-iot/organizations/integrate-overview':659 '/en-us/azure/defender-for-iot/organizations/integrations/arcsight':1374 '/en-us/azure/defender-for-iot/organizations/integrations/logrhythm':1384 '/en-us/azure/defender-for-iot/organizations/integrations/netwitness':1395 '/en-us/azure/defender-for-iot/organizations/integrations/on-premises-sentinel':1408 '/en-us/azure/defender-for-iot/organizations/integrations/send-cloud-data-to-partners':1420 '/en-us/azure/defender-for-iot/organizations/integrations/service-now-legacy':1431 '/en-us/azure/defender-for-iot/organizations/iot-advanced-threat-monitoring':1441 '/en-us/azure/defender-for-iot/organizations/iot-solution':1451 '/en-us/azure/defender-for-iot/organizations/license-and-trial-license-extention':669 '/en-us/azure/defender-for-iot/organizations/manage-users-portal':870 '/en-us/azure/defender-for-iot/organizations/manage-users-sensor':882 '/en-us/azure/defender-for-iot/organizations/monitor-zero-trust':892 '/en-us/azure/defender-for-iot/organizations/networking-requirements':1222 '/en-us/azure/defender-for-iot/organizations/onboard-sensors':1755 '/en-us/azure/defender-for-iot/organizations/ot-appliance-sizing':680 '/en-us/azure/defender-for-iot/organizations/ot-deploy/activate-deploy-sensor':1766 '/en-us/azure/defender-for-iot/organizations/ot-deploy/air-gapped-deploy':693 '/en-us/azure/defender-for-iot/organizations/ot-deploy/create-ssl-certificates':904 '/en-us/azure/defender-for-iot/organizations/ot-deploy/install-software-ot-sensor':1776 '/en-us/azure/defender-for-iot/organizations/ot-deploy/ot-deploy-path':1786 '/en-us/azure/defender-for-iot/organizations/ot-deploy/post-install-validation-ot-software':551 '/en-us/azure/defender-for-iot/organizations/ot-deploy/provision-cloud-management':1232 '/en-us/azure/defender-for-iot/organizations/ot-deploy/transition-on-premises-management-console-to-cloud':706 '/en-us/azure/defender-for-iot/organizations/ot-pre-configured-appliances':781 '/en-us/azure/defender-for-iot/organizations/ot-virtual-appliances':793 '/en-us/azure/defender-for-iot/organizations/recommendations':916 '/en-us/azure/defender-for-iot/organizations/references-data-retention':803 '/en-us/azure/defender-for-iot/organizations/references-work-with-defender-for-iot-apis':1462 '/en-us/azure/defender-for-iot/organizations/respond-ot-alert':927 '/en-us/azure/defender-for-iot/organizations/roles-azure':938 '/en-us/azure/defender-for-iot/organizations/roles-on-premises':950 '/en-us/azure/defender-for-iot/organizations/sensor-health-messages':561 '/en-us/azure/defender-for-iot/organizations/set-up-sso':961 '/en-us/azure/defender-for-iot/organizations/track-user-activity':972 '/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-erspan':1243 '/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-esxi':1253 '/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-hyper-v':1265 '/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-rspan':1276 '/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-span':1287 '/en-us/azure/defender-for-iot/organizations/traffic-mirroring/set-up-traffic-mirroring':1796 '/en-us/azure/defender-for-iot/organizations/tutorial-cyberark':1474 '/en-us/azure/defender-for-iot/organizations/tutorial-forescout':1484 '/en-us/azure/defender-for-iot/organizations/tutorial-fortinet':1494 '/en-us/azure/defender-for-iot/organizations/tutorial-palo-alto':1505 '/en-us/azure/defender-for-iot/organizations/tutorial-qradar':1516 '/en-us/azure/defender-for-iot/organizations/tutorial-servicenow':1528 '/en-us/azure/defender-for-iot/organizations/tutorial-splunk':1538 '/en-us/azure/defender-for-iot/organizations/workbooks':1549 '/microsoftdocs/mcp/blob/main/readme.md)':170 '11':1622,1635,1702 '2':1714 '2lff':1637,1675 '3':141 '4sff':1623 'accept':209 'access':175,1452 'across':467,1559 'activ':381,461,964,1107,1123,1758 'agent':90,134,193,207,229,392,427,475,502,515,992,1007,1034,1043,1052,1078,1089,1296,1309 'agent-bas':1077 'agents/sensors':390 'air':685 'air-gap':684 'alert':238,374,395,436,477,494,503,527,843,855,922,979,1068,1321,1348,1358,1379,1389,1414,1513 'align':324 'allow':1223 'altern':1030 'alto':1497 'analyz':829 'api':430,815,1310,1323,1332,1341,1459 'appli':566,883,1212 'applianc':290,345,455,673,778,790,1567,1611,1716,1727 'appliance-specif':454 'appropri':671 'architectur':20,59,304,310,707,713,741 'arcsight':1370 'assign':860,1062 'audit':377,962,1016 'auth':368 'authent':810 'autom':435,1345 'avail':160 'azur':2,9,38,49,317,719,845,861,924,929,981,1134,1155,1228,1545,1752 'azure-defender-for-iot':1 'base':580,1079 'behavior':993 'benchmark':264,579 'benchmark-bas':578 'best':16,55,245,250,562 'bill':294,643 'built':490 'built-in':489 'ca':895 'ca-sign':894 'capabl':82 'catalog':346,773 'categori':93,101,117,213,215 'central':1132 'certif':371,821,898 'chang':835 'choos':286,614,649,660 'cis':263,577 'cisco':1236,1267,1278 'cli':1101 'cloud':302,703,1413 'code':28,67,409,1289 'combin':72 'command':1102 'configur':26,37,65,244,382,386,939,951,973,976,987,1011,1026,1038,1049,1072,1106,1128,1139,1149,1190,1233,1244,1254,1266,1277,1421,1756,1770 'connect':313,401,715,727,1153,1226,1396,1442 'consol':958,1186 'content':77,179 'correct':1791 'cover':53 'creat':893,1060,1084 'credenti':1470 'custom':493,977,1063 'cyberark':1464 'data':353,798,1166,1174,1456,1543 'decid':626 'decis':18,57,274,610 'decod':1028 'defend':3,10,39,50,225,256,282,325,350,363,387,415,447,473,485,500,511,523,533,542,553,567,581,591,604,620,633,640,652,663,675,687,695,735,750,763,785,795,812,840,865,906,933,945,954,967,988,1005,1022,1032,1039,1050,1064,1074,1085,1096,1216,1238,1271,1294,1307,1366,1376,1386,1400,1410,1426,1443,1453,1466,1479,1489,1500,1510,1523,1533,1540,1554,1569,1683,1694,1748,1759,1778 'dell':1576,1587,1598 'depend':394,1002 'deploy':31,34,70,285,328,440,446,690,1550,1582,1593,1604,1608,1682,1693,1706,1720,1731,1782,1787 'descript':217 'design':21,60,305,708 'detect':1436 'develop':13 'devic':1056,1067,1173 'diagnos':222 'disconnect':1347 'dl20':1620,1633,1648,1659,1671 'dl360':1689,1700 'dmi':1027 'dns':1119 'doc':185 'document':80,178 'dps':1300 'e.g':105,121 'eclips':1054,1312 'endpoint':1141,1165,1229 'enrich':1163 'enterpris':1651,1663 'environ':367 'erspan':1234 'esxi':1245,1725 'event':832,1020 'expert':6,46 'extend':662 'extern':1416 'fallback':197 'featur':344,753 'fetch':81,177,186,199 'file':111,119,126,131 'firewal':420,1487,1498 'fit2':1737 'fix':224 'forescout':1476 'fortinet':1486 'forward':1355 'gap':686 'gen':1621,1634,1701,1713 'gen10':1649,1660,1672 'github.com':169 'github.com/microsoftdocs/mcp/blob/main/readme.md)':168 'guid':167,457 'guidanc':47,265,279,311,480 'hardware/vm':452 'health':237,548,557,1197 'heptagon':1609 'hpe':1619,1632,1647,1658,1670,1687,1698 'hub':260,488,570,983,1299 'hybrid':682 'hybrid/air-gapped':295 'hyper':1256,1711 'hyper-v':1255,1710 'ibm':1507 'import':88,132,1170 'includ':14 'index':94,214 'individu':1181 'info':338 'initi':1769 'instal':164,166,242,547,1767 'integr':27,66,293,408,414,656,1288,1314,1318,1327,1365,1424,1463,1475,1485,1495,1506,1517,1529 'intel':406 'intellig':1203 'interpret':552 'inventori':1330 'inventory/vulnerabilities':439 'investig':520,576,917 'iot':5,12,41,52,227,258,284,327,352,365,389,417,449,464,487,513,525,535,544,555,569,593,606,622,635,642,654,665,677,689,697,737,752,765,787,797,814,842,867,908,935,947,956,969,982,990,1041,1066,1076,1087,1098,1218,1240,1273,1298,1368,1378,1388,1402,1412,1428,1437,1445,1455,1468,1481,1491,1502,1512,1525,1535,1542,1556,1571,1685,1696,1750,1761,1780 'iot/ot':254 'iotsecuritysolut':1557 'issu':233,516 'knowledg':7 'l103':361 'l104':384 'l104-l135':383 'l120':108 'l135':385 'l136':412 'l136-l163':411 'l163':413 'l164':442 'l164-l187':441 'l187':443 'l35':107 'l35-l120':106 'l37':220 'l37-l48':219 'l48':221 'l49':248 'l49-l56':247 'l56':249 'l57':277 'l57-l68':276 'l68':278 'l69':308 'l69-l75':307 'l75':309 'l76':336 'l76-l84':335 'l84':337 'l85':360 'l85-l103':359 'latest':149 'layer':332 'learn':192,206 'learn-agent-skil':191,205 'learn.microsoft.com':482,496,507,518,529,539,550,560,574,584,595,608,624,637,647,658,668,679,692,705,721,732,743,759,770,780,792,802,817,827,837,848,858,869,881,891,903,915,926,937,949,960,971,985,998,1009,1024,1036,1047,1058,1070,1082,1093,1104,1114,1126,1137,1147,1157,1168,1178,1188,1199,1210,1221,1231,1242,1252,1264,1275,1286,1304,1316,1325,1334,1343,1353,1363,1373,1383,1394,1407,1419,1430,1440,1450,1461,1473,1483,1493,1504,1515,1527,1537,1548,1562,1573,1584,1595,1606,1616,1629,1643,1655,1667,1680,1691,1704,1718,1729,1742,1754,1765,1775,1785,1795 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-agent-based-security-alerts':481 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-customizable-security-alerts':984 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-micro-agent-configuration':997 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-micro-agent-linux-dependencies':1008 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-recommendations':573 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-security-alerts':495 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/concept-threadx-security-alerts-recommendations':506 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/configure-pam-to-audit-sign-in-events':1023 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/edge-security-module-deprecation':758 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-configure-dmi-decoder':1035 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-configure-micro-agent-twin':1046 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-investigate-cis-benchmark':583 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-provision-micro-agent':1303 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-region-move':1561 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/how-to-threadx-security-module':1057 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/quickstart-create-custom-alerts':1069 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/threadx-security-module-api':1315 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/troubleshoot-defender-micro-agent':517 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/tutorial-configure-agent-based-solution':1081 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/tutorial-create-micro-agent-module-twin':1092 'learn.microsoft.com/en-us/azure/defender-for-iot/device-builders/tutorial-investigate-security-alerts':528 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-alert-apis':1324 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-auth-apis':816 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-inventory-apis':1333 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/api/sensor-vulnerability-apis':1342 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/':1572 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r350-e1800':1583 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r360-e1800':1594 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/dell-poweredge-r660':1605 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/heptagon-yb3x':1615 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-gen-11':1628 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-gen-11-nhp-2lff':1642 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-legacy':1654 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-plus-enterprise':1666 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl20-plus-smb':1679 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl360':1690 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/hpe-proliant-dl360-gen11':1703 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/virtual-sensor-hyper-v':1717 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/virtual-sensor-vmware':1728 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/appliance-catalog/ys-techsystems-ys-fit2':1741 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/architecture-connections':720 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/automate-sensor-disconnection-alerts':1352 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/certificate-requirements':826 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/plan-corporate-monitoring':594 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/plan-prepare-deploy':607 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/sample-connectivity-models':731 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/traffic-mirroring-methods':623,636 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/best-practices/understand-network-architecture':742 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/billing':646 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/cli-ot-sensor':1103 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/configure-active-monitoring':1113 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/configure-reverse-dns-lookup':1125 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/configure-sensor-settings-portal':1136 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/configure-windows-endpoint-monitoring':1146 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/connect-sensors':1156 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/detect-windows-endpoints-script':1167 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/getting-started':769 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-analyze-programming-details-changes':836 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-forward-alert-information-to-partners':1362 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-import-device-information':1177 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-manage-cloud-alerts':847 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-manage-individual-sensors':1187 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-set-up-snmp-mib-monitoring':1198 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-troubleshoot-sensor':538 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-view-alerts':857 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/how-to-work-with-threat-intelligence-packages':1209 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrate-overview':657 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/arcsight':1372 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/logrhythm':1382 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/netwitness':1393 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/on-premises-sentinel':1406 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/send-cloud-data-to-partners':1418 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/integrations/service-now-legacy':1429 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/iot-advanced-threat-monitoring':1439 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/iot-solution':1449 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/license-and-trial-license-extention':667 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/manage-users-portal':868 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/manage-users-sensor':880 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/monitor-zero-trust':890 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/networking-requirements':1220 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/onboard-sensors':1753 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-appliance-sizing':678 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/activate-deploy-sensor':1764 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/air-gapped-deploy':691 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/create-ssl-certificates':902 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/install-software-ot-sensor':1774 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/ot-deploy-path':1784 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/post-install-validation-ot-software':549 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/provision-cloud-management':1230 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-deploy/transition-on-premises-management-console-to-cloud':704 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-pre-configured-appliances':779 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/ot-virtual-appliances':791 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/recommendations':914 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/references-data-retention':801 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/references-work-with-defender-for-iot-apis':1460 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/respond-ot-alert':925 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/roles-azure':936 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/roles-on-premises':948 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/sensor-health-messages':559 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/set-up-sso':959 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/track-user-activity':970 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-erspan':1241 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-esxi':1251 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-hyper-v':1263 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-rspan':1274 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/configure-mirror-span':1285 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/traffic-mirroring/set-up-traffic-mirroring':1794 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-cyberark':1472 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-forescout':1482 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-fortinet':1492 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-palo-alto':1503 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-qradar':1514 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-servicenow':1526 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/tutorial-splunk':1536 'learn.microsoft.com/en-us/azure/defender-for-iot/organizations/workbooks':1547 'legaci':1405,1422,1646 'licens':291,645,666 'limit':23,62,333,357,745,800 'line':103,115,216 'link':120,129 'linux':1001,1014 'local':73,856,1160 'locat':97 'logrhythm':1381 'lookup':1120 'maintain':1180 'make':19,58,275,611 'manag':438,807,839,852,871,1201,1322,1331,1340,1521 'map':734,928 'markdown':196,212 'mcp':155,182 'meet':819,1000 'messag':558 'metadata.generated':136 'method':403,618,631,1109 'mib':1192 'micro':228,391,426,474,501,514,991,1006,1033,1042,1051,1088,1295,1308 'microsoft':184,510,532,966,1073,1447,1478,1532 'microsoftdoc':156,183 'mirror':289,400,459,617,630,1250,1262,1269,1281,1793 'mode':1248,1260 'model':331,728 'modul':995,1090 'monitor':269,402,588,777,886,1108,1124,1142,1193,1566,1614,1627,1641,1653,1665,1740 'month':142 'move':463,1553 'netwit':1392 'network':174,321,726,878,889,1112,1213 'nhp':1636,1674 'old':143 'on-premis':298,699,872,940,1397 'onboard':460,1744 'oper':1519 'option':453 'ot':35,231,268,287,320,340,366,396,423,450,536,545,587,598,615,628,672,716,725,740,766,776,788,808,824,830,853,877,888,900,921,1099,1111,1122,1129,1144,1150,1172,1182,1195,1207,1224,1283,1319,1328,1337,1356,1565,1580,1591,1602,1613,1626,1640,1652,1664,1678,1707,1721,1739,1745,1762,1771,1781,1788 'ot/ics':314 'packag':1204 'palo':1496 'pam':1012 'partner':292,655,1360 'pattern':22,29,61,68,306,410,709,1290 'phase':1783 'placement':273,602 'plan':267,281,444,586,639,651,681,768 'playbook':431,1351 'plus':428,1661,1673 'port':1280 'portal':846,1135 'poweredg':1577,1588,1599 'practic':17,56,246,251,563 'preconfigur':775 'prefer':180 'premis':300,701,874,942,1399 'prepar':597 'program':380,831 'proliant':1688,1699 'promiscu':1247,1259 'properti':1045 'provid':45 'provis':1293 'proxi':1152 'pull':147 'purdu':330,739 'qradar':1508 'queri':188,202 'quick':75 'quick-refer':74 'quota':24,63,334,746 'r350':1578 'r360':1589 'r660':1600 'rang':104 'rbac':862,930 'rbac/roles':369 'read':110,125 'recommend':262,505,572,582,910 'reduc':912 'refer':76,130 'region':468,1560 'relev':98 'remedi':479,522 'remot':79 'repositori':153 'requir':173,348,783,822,1003,1214 'resourc':466,1558 'respond':919 'rest':1458 'retent':354,799 'retir':756 'return':195,211 'revers':1118 'review':772 'risk':913 'role':863,931,943 'rsa':1391 'rspan':1268 'sampl':319,724 'script':1161 'section':99 'secur':25,64,235,253,261,358,362,465,476,526,571,804,909,978,1471 'security.md':122,123 'select':670,712,1564 'send':1375,1385 'sensor':36,232,272,315,397,424,451,537,546,556,601,717,730,809,825,854,879,901,957,1100,1130,1145,1151,1176,1183,1185,1196,1208,1219,1225,1284,1320,1329,1338,1346,1357,1581,1592,1603,1708,1722,1746,1763,1772,1789 'sensor/agent':241 'sentinel':422,1350,1404,1433,1448 'servicenow':421,1423,1518 'set':398,761,1116,1131 'setup':296,342 'siem':419,1371,1417 'sign':896,1018 'sign-in':1017 'site':599 'skill':42,44,87,172,194,208 'skill-azure-defender-for-iot' 'smb':1625 'smb/l500':1639,1677 'snmp':1191 'softwar':1773 'solut':1080,1434 'source-microsoftdocs' 'span':1279 'specif':456 'specifi':114 'splunk':1530 'ssl/tls':820,897 'sso':370,952 'storag':356 'stream':1409 'string':189,203 'suggest':144,161 'supplement':1171 'support':754 'supported/retiring':343 'suspici':834 'system':782,1361 'technolog':1520 'techsystem':1734 'text/markdown':210 'threadx':499,1055,1313 'threat':405,1202,1438 'timelin':757 'tool':157 'topic':470,564,612,710,747,805,974,1291,1551 'topic-agent' 'topic-agent-skills' 'topic-agentic-skills' 'topic-agentskill' 'topic-ai-agents' 'topic-ai-coding' 'topic-azure' 'topic-azure-functions' 'topic-azure-kubernetes-service' 'topic-azure-openai' 'topic-azure-sql-database' 'topic-azure-storage' 'topolog':270,322,589 'traffic':288,399,458,616,629,1792 'transit':303,694 'trial':341,767 'troubleshoot':15,54,218,469,509,531 'trust':373,885 'twin':393,996,1044,1091 'understand':749,794,1777 'understanding/handling':234 'updat':407,1205 'url':471,565,613,711,748,806,975,1292,1552 'use':32,85,91,109,124,181,198,259,318,429,472,484,498,723,905,1095,1159,1297,1306,1336,1432,1575,1586,1597,1618,1631,1645,1657,1669 'user':146,163,378,875,963 'v':1257,1712 'valid':240,541 'version':150 'via':811,994,1184,1457 'view':850 'virtual':789,1715,1726 'visual':1539 'vmware':1724 'vswitch':1246,1258 'vulner':1339 'webpag':200 'window':1140,1164 'workbook':433,1546 'workflows/response':375 'x.509':1302 'yb3x':1610 'ys':1733,1736 'ys-fit2':1735 'ys-techsystem':1732 'zero':372,884","prices":[{"id":"bc71dbad-4746-4401-8d79-84d251bfafe7","listingId":"5c427fe2-e8b6-4e83-941a-5b48030f2e64","amountUsd":"0","unit":"free","nativeCurrency":null,"nativeAmount":null,"chain":null,"payTo":null,"paymentMethod":"skill-free","isPrimary":true,"details":{"org":"MicrosoftDocs","category":"Agent-Skills","install_from":"skills.sh"},"createdAt":"2026-04-18T21:58:51.461Z"}],"sources":[{"listingId":"5c427fe2-e8b6-4e83-941a-5b48030f2e64","source":"github","sourceId":"MicrosoftDocs/Agent-Skills/azure-defender-for-iot","sourceUrl":"https://github.com/MicrosoftDocs/Agent-Skills/tree/main/skills/azure-defender-for-iot","isPrimary":false,"firstSeenAt":"2026-04-18T21:58:51.461Z","lastSeenAt":"2026-04-22T06:53:31.443Z"}],"details":{"listingId":"5c427fe2-e8b6-4e83-941a-5b48030f2e64","quickStartSnippet":null,"exampleRequest":null,"exampleResponse":null,"schema":null,"openapiUrl":null,"agentsTxtUrl":null,"citations":[],"useCases":[],"bestFor":[],"notFor":[],"kindDetails":{"org":"MicrosoftDocs","slug":"azure-defender-for-iot","github":{"repo":"MicrosoftDocs/Agent-Skills","stars":497,"topics":["agent","agent-skills","agentic-skills","agentskill","ai","ai-agents","ai-coding","azure","azure-functions","azure-kubernetes-service","azure-openai","azure-sql-database","azure-storage","azure-virtual-machine","claude-code","github-copilot","microsoft-learn","openai-codex","skills"],"license":"cc-by-4.0","html_url":"https://github.com/MicrosoftDocs/Agent-Skills","pushed_at":"2026-04-22T01:37:27Z","description":"Curated Agent Skills for Microsoft & Azure – giving AI coding assistants structured, real-time expertise from Microsoft Learn docs.","skill_md_sha":"ca1f7b761edfd133c423388d0b28424271e482f6","skill_md_path":"skills/azure-defender-for-iot/SKILL.md","default_branch":"main","skill_tree_url":"https://github.com/MicrosoftDocs/Agent-Skills/tree/main/skills/azure-defender-for-iot"},"layout":"multi","source":"github","category":"Agent-Skills","frontmatter":{"name":"azure-defender-for-iot","description":"Expert knowledge for Azure Defender For Iot development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when deploying OT sensors, configuring micro agents, setting up traffic mirroring, or integrating with Sentinel/SIEM, and other Azure Defender For Iot related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Security (use azure-security), Azure External Attack Surface Management (use azure-external-attack-surface-management), Azure Sentinel (use azure-sentinel).","compatibility":"Requires network access. Uses mcp_microsoftdocs:microsoft_docs_fetch or fetch_webpage to retrieve documentation."},"skills_sh_url":"https://skills.sh/MicrosoftDocs/Agent-Skills/azure-defender-for-iot"},"updatedAt":"2026-04-22T06:53:31.443Z"}}