Integrations with Microsoft and partner services

Integrate Microsoft Defender for Iot with partner services to view partner data in Defender for IoT, or to view Defender for IoT data in a partner service.

Aruba ClearPass

Name	Description	Support scope	Supported by	Learn more
Aruba ClearPass	Share Defender for IoT data with ClearPass Security Exchange and update the ClearPass Policy Manager Endpoint Database with Defender for IoT data.	- OT networks - Locally managed sensors and on-premises management consoles	Microsoft	Integrate ClearPass with Microsoft Defender for IoT

Axonius

Name	Description	Support scope	Supported by	Learn more
Axonius Cybersecurity Asset Management	Import and manage device inventory discovered by Defender for IoT in your Axonius instance.	- OT networks - Locally managed sensors and on-premises management consoles	Axonius	Axonius documentation

CyberArk PSM

Name	Description	Support scope	Supported by	Learn more
CyberArk Privileged Session Manager (PSM)	Send CyberArk PSM syslog data on remote sessions and verification failures to Defender for IoT for data correlation.	- OT networks - Locally managed sensors and on-premises management consoles	Microsoft	Integrate CyberArk with Microsoft Defender for IoT

Forescout

Name	Description	Support scope	Supported by	Learn more
Forescout	Automate actions in Forescout based on activity detected by Defender for IoT, and correlate Defender for IoT data with other Forescout eyeExtended modules that oversee monitoring, incident management, and device control.	- OT networks - Locally managed sensors and on-premises management consoles	Microsoft	Integrate Forescout with Microsoft Defender for IoT

Fortinet

Name	Description	Support scope	Supported by	Learn more
Fortinet FortiSIEM and FortiGate	Send Defender for IoT data to Fortinet services for: - Enhanced network visibility in FortiSIEM - Extra abilities in FortiGate to stop anomalous behavior	- OT networks - Locally managed sensors and on-premises management consoles	Microsoft	Integrate Fortinet with Microsoft Defender for IoT

IBM QRadar

Name	Description	Support scope	Supported by	Learn more
IBM QRadar	Send Defender for IoT alerts to IBM QRadar	- OT networks - Cloud connected sensors	Microsoft	Stream Defender for IoT cloud alerts to a partner SIEM
IBM QRadar	Forward Defender for IoT alerts to IBM QRadar.	- OT networks - Locally managed sensors and on-premises management consoles	Microsoft	Integrate Qradar with Microsoft Defender for IoT

LogRhythm

Name	Description	Support scope	Supported by	Learn more
LogRhythm	Forward Defender for IoT alerts to LogRhythm.	- OT networks - Locally managed sensors and on-premises management consoles	Microsoft	Integrate LogRhythm with Microsoft Defender for IoT

Micro Focus ArcSight

Name	Description	Support scope	Supported by	Learn more
Micro Focus ArcSight	Forward Defender for IoT alerts to ArcSight.	- OT networks - Locally managed sensors and on-premises management consoles	Microsoft	Integrate ArcSight with Microsoft Defender for IoT

Microsoft Defender for Endpoint

Name	Description	Support scope	Supported by	Learn more
Microsoft Defender for Endpoint	Integrates Defender for IoT data in Defender for Endpoint's device inventory, alerts, recommendations, and vulnerabilities. Displays device data about Defender for Endpoint endpoints in the Defender for IoT Device inventory page on the Azure portal.	- Enterprise IoT networks and sensors	Microsoft	Onboard with Microsoft Defender for IoT

Microsoft Sentinel

Name	Description	Support scope	Supported by	Learn more
Defender for IoT data connector in Microsoft Sentinel	Displays Defender for IoT cloud data in Microsoft Sentinel, supporting end-to-end SOC investigations for Defender for IoT alerts.	- OT and Enterprise IoT networks - Cloud-connected sensors	Microsoft	Integrate Microsoft Sentinel and Microsoft Defender for IoT
Microsoft Sentinel	Send Defender for IoT alerts from on-premises resources to Microsoft Sentinel.	- OT networks - Locally managed sensors and on-premises management consoles	Microsoft	Connect on-premises OT network sensors to Microsoft Sentinel

Palo Alto

Name	Description	Support scope	Supported by	Learn more
Palo Alto	Use Defender for IoT data to block critical threats with Palo Alto firewalls, either with automatic blocking or with blocking recommendations.	- OT networks - Locally managed sensors and on-premises management consoles	Microsoft	Integrate Palo-Alto with Microsoft Defender for IoT

RSA NetWitness

Name	Description	Support scope	Supported by	Learn more
RSA NetWitness	Forward Defender for IoT alerts to RSA NetWitness	- OT networks - Locally managed sensors and on-premises management consoles	Microsoft	Integrate RSA NetWitness with Microsoft Defender for IoT Defender for IoT - RSA NetWitness CEF Parser Implementation Guide

ServiceNow

Name	Description	Support scope	Supported by	Learn more
Vulnerability Response Integration with Microsoft Azure Defender for IoT	View Defender for IoT device vulnerabilities in ServiceNow.	- OT networks - Locally managed sensors and on-premises management consoles	ServiceNow	ServiceNow store
Service Graph Connector Integration with Microsoft Azure Defender for IoT	View Defender for IoT device detections, sensors, and network connections in ServiceNow.	- OT networks - Locally managed sensors and on-premises management consoles	ServiceNow	ServiceNow store
Microsoft Defender for IoT (Legacy)	View Defender for IoT device detections and alerts in ServiceNow.	- OT networks - Locally managed sensors and on-premises management consoles	Microsoft	ServiceNow store Integrate ServiceNow with Microsoft Defender for IoT

Skybox

Name	Description	Support scope	Supported by	Learn more
Skybox	Import vulnerability occurrence data discovered by Defender for IoT in your Skybox platform.	- OT networks - Locally managed sensors and on-premises management consoles	Skybox	Skybox documentation Skybox integration page

Splunk

Name	Description	Support scope	Supported by	Learn more
Splunk	Send Defender for IoT alerts to Splunk	- OT networks - Cloud connected sensors	Microsoft	Stream Defender for IoT cloud alerts to a partner SIEM
Splunk	Send Defender for IoT alerts to Splunk	- OT networks - Locally managed sensors and on-premises management consoles	Microsoft	Integrate Splunk with Microsoft Defender for IoT

Next steps

Stream Defender for IoT cloud alerts to a partner SIEM