Make sure SNMP read-only is enabled on all configured network devices to allow the Defender for Endpoint assessment device to query the configured network devices. SNMP traffic between the Defender for Endpoint assessment device and the targeted network devices must be allowed (for example, by the Firewall).ĭecide which network devices will be assessed for vulnerabilities (for example: a Cisco switch or a Palo Alto Networks firewall). Your first step is to select a device that will perform the authenticated network scans.ĭecide on a Defender for Endpoint onboarded device (client or server) that has a network connection to the management port for the network devices you plan on scanning. Therefore, you are encouraged to configure all your network devices, even if they're not specified in this list. More networking vendors and OS will be added over time, based on data gathered from customer usage. The following operating systems are currently supported: Once the network devices are discovered and classified, security administrators will be able to receive the latest security recommendations and review recently discovered vulnerabilities on network devices deployed across their organizations. Vulnerability management for network devices Network devices: The network devices you plan to scan and onboard.Assessment device: A device that's already onboarded that you'll use to scan the network devices.There will be two types of devices to keep in mind: Depending on the network topology and characteristics, a single device or a few devices onboarded to Microsoft Defender for Endpoint will perform authenticated scans of network devices using SNMP (read-only). These types of devices require an agentless approach where a remote scan will obtain the necessary information from the devices. Network devices are not managed as standard endpoints since Defender for Endpoint doesn't have a sensor built into the network devices themselves. Once discovered, Defender for Endpoint's Vulnerability Management capabilities provide integrated workflows to secure discovered switches, routers, WLAN controllers, firewalls, and VPN gateways. Network discovery capabilities are available in the Device inventory section of the Microsoft 365 Defender portal and Microsoft 365 Defender consoles.Ī designated Microsoft Defender for Endpoint device will be used on each network segment to perform periodic authenticated scans of preconfigured network devices. This article provides an overview of the challenge that Network device discovery is designed to address, and detailed information about how get started using these new capabilities. The Network device discovery and vulnerability assessments Blog (published 04-13-2021) provides insights into the new Network device discovery capabilities in Defender for Endpoint.

Add ubiquiti device discovery tool