Device discovery overview (Microsoft)

Protecting your environment requires taking inventory of the devices that are in your network. However, mapping devices in a network can often be expensive, challenging, and time-consuming.

Microsoft Defender for Endpoint provides a device discovery capability that helps you find unmanaged devices connected to your corporate network without the need for extra appliances or cumbersome process changes. Device discovery uses onboarded endpoints, in your network to collect, probe, or scan your network to discover unmanaged devices. The device discovery capability allows you to discover:

• Enterprise endpoints (workstations, servers and mobile devices) that are not yet onboarded to Microsoft Defender for Endpoint
• Network devices like routers and switches
• IoT devices like printers and cameras

Unknown and unmanaged devices introduce significant risks to your network – whether it’s an unpatched printer, network devices with weak security configurations, or a server with no security controls. Once devices are discovered, you can:

• Onboard unmanaged endpoints to the service, increasing the security visibility on them.
• Reduce the attack surface by identifying and assessing vulnerabilities, and detecting configuration gaps.

Watch this video for a quick overview of how device discovery:

In conjunction with this capability, a security recommendation to onboard devices to Microsoft Defender for Endpoint is available as part of the existing Threat and Vulnerability Management experience.

Discovery methods

You can choose the discovery mode to be used by your onboarded devices. The mode controls the level of visibility you can get for unmanaged devices in your corporate network.

There are two modes of discovery available:

• Basic discovery: In this mode, endpoints will passively collect events in your network and extract device information from them. Basic discovery uses the SenseNDR.exe binary for passive network data collection and no network traffic will be initiated. Endpoints will simply extract data from every network traffic that is seen by an onboarded device. With basic discovery, you’ll only gain limited visibility of unmanaged endpoints in your network.
• Standard discovery (recommended): This mode allows endpoints to actively find devices in your network to enrich collected data and discover more devices – helping you build a reliable and coherent device inventory. In addition to devices that were observed using the passive method, standard mode also leverages common discovery protocols that use multicast queries in the network to find even more devices. Standard mode uses smart, active probing to discover additional information about observed devices to enrich existing device information. When Standard mode is enabled, minimal, and negligible network activity generated by the discovery sensor might be observed by network monitoring tools in your organization.

You can change and customize your discovery settings, for more information, see Configure device discovery.

Device Inventory

Devices that have been discovered but have not yet been onboarded and secured by Microsoft Defender for Endpoint will be listed in Device Inventory within the Endpoints tab.

You can use a filter in the device inventory list called Onboarding status, which can have any of the following values:

• Onboarded: The endpoint is onboarded to Microsoft Defender for Endpoint.
• Can be onboarded: The endpoint was discovered in the network and the Operating System was identified as one that is supported by Microsoft Defender for Endpoint, but it is not currently onboarded. We highly recommend onboarding these devices.
• Unsupported: The endpoint was discovered in the network but is not supported by Microsoft Defender for Endpoint.
• Insufficient info: The system could not determine the supportability of the device. Enabling standard discovery on more devices in the network can enrich the discovered attributes.

Network device discovery

The large number of unmanaged network devices deployed in an organization creates a large surface area of attack, and represents a significant risk to the entire enterprise. Microsoft Defender for Endpoint network discovery capabilities helps you ensure network devices are discovered, accurately classified, and added to the asset inventory.

Network devices are not managed as standard endpoints, as Defender for Endpoint doesn’t have a sensor built into the network devices themselves. These types of devices require an agentless approach where a remote scan will obtain the necessary information from the devices. To do this, a designated Microsoft Defender for Endpoint device will be used on each network segment to perform periodic authenticated scans of preconfigured network devices. Once discovered, Defender for Endpoint’s threat and vulnerability management capabilities provide integrated workflows to secure discovered switches, routers, WLAN controllers, firewalls, and VPN gateways.

For more information, see Network devices.

Device discovery Integrations

To address the challenge of gaining enough visibility to locate, identify, and secure your complete OT/IOT asset inventory Microsoft Defender for Endpoint now supports the following integrations:

• Corelight: Microsoft has partnered with Corelight to receive data from Corelight network appliances. This provides Microsoft 365 Defender with increased visibility into the network activities of unmanaged devices, including communication with other unmanaged devices or external networks. for more information, see Enable Corelight data integration.
• Microsoft Defender for IoT: This integration combines Microsoft Defender for Endpoint’s device discovery capabilities, with the agentless monitoring capabilities of Microsoft Defender for IoT, to secure enterprise IoT devices connected to an IT network (for example, Voice over Internet Protocol (VoIP), printers, and smart TVs). For more information, see Enable Microsoft Defender for IoT integration.

Vulnerability assessment on discovered devices

Vulnerabilities and risks on your devices as well as other discovered unmanaged devices in the network are part of the current TVM flows under “Security Recommendations” and represented in entity pages across the portal. Search for “SSH” related security recommendations to find SSH vulnerabilities that are related for unmanaged and managed devices.

Use Advanced Hunting on discovered devices

You can use Advanced Hunting queries to gain visibility on discovered devices. Find details about discovered Endpoints in the DeviceInfo table, or network-related information about those devices in the DeviceNetworkInfo table.

Device discovery leverages Microsoft Defender for Endpoint onboarded devices as a network data source to attribute activities to non-onboarded devices. This means that if a Microsoft Defender for Endpoint onboarded device communicated with a non-onboarded device, activities on the non-onboarded device can be seen on the timeline and through the Advanced hunting DeviceNetworkEvents table.

New events are Transmission Control Protocol (TCP) connections-based and will fit to the current DeviceNetworkEvents scheme. TCP ingress to the Microsoft Defender for Endpoint enabled device from a non-Microsoft Defender for Endpoint enabled.

The following action types have also been added:

• ConnectionAttempt – An attempt to establish a TCP connection (syn)
• ConnectionAcknowledged – An acknowledgment that a TCP connection was accepted (syn\ack)

You can try this example query:

DeviceNetworkEvents
| where ActionType == "ConnectionAcknowledged" or ActionType == "ConnectionAttempt"
| take 10

Changed behavior

The following section lists the changes you’ll observe in Microsoft Defender for Endpoint and Microsoft 365 Defender portal when this capability is enabled.

1. Devices that are not onboarded to Microsoft Defender for Endpoint are expected to appear in the device inventory, advanced hunting, and API queries. This may significantly increase the size of query results.
   1. “DeviceInfo” and “DeviceNetworkInfo” tables in Advanced Hunting will now hold discovered device. You can filter out those devices by using “OnboardingStatus” attribute.
   2. Discovered devices are expected to appear in Streaming API query results. You can filter out those devices by using the OnboardingStatus filter in your query.
2. Unmanaged devices will be assigned to existing device groups based on the defined criteria.
3. In rare cases, Standard discovery might trigger alerts on network monitors or security tools. Please provide feedback, if you experience such events, to help prevent these issues from recurring. You can explicitly exclude specific targets or entire subnets from being actively probed by Standard discovery.

Source : Official Microsoft Brand
Editor by : BEST Antivirus KBS Team