Attribute mapping and classification for Service Graph Connector for Microsoft Defender for IoT (Azure)

The following tables describe the attribute mapping and classification for sensors and devices.

Table 1. Sensors attribute mapping

Payload field name	Data type	Mapped to table	Mapped to field	Description
id	String format: /subscriptions/<subscription-id>/provider/<provider>/locations/<location>/sites/<site>/sensor/<sensor-name>	sys_object_source cmdb_ci_nids	snk in sys_object_source correlation_id	Unique ID for the sensor.
name	String	cmdb_ci_nids	name	Name of the sensor.
properties.hostname	String	cmdb_ci_nids	fqdn	Host name of the sensor.
properties.ip	String	cmdb_ci_ip_address	ip_address	IP address of the sensor.
properties.learningMode	Boolean	cmdb_ci_nids	False or unavailable: Life Cycle Stage (life_cycle_stage) : Operational Life Cycle Stage Status (life_cycle_stage_status): In Use True: Life Cycle Stage (life_cycle_stage) : Operational Life Cycle Stage Status (life_cycle_stage_status): Learning	Learning mode status of the IoT sensor.
properties.mac	String	cmdb_ci_network_adapter	name, mac_address	MAC address of the sensor.
properties.sensorStatus	String	cmdb_ci_nids	connection_state	Status of the IoT sensor.
properties.sensorVersion	String	cmdb_ci_nids	firmware_version	Version of the IoT sensor.
properties.upSince_utc	Date and time as string	cmdb_ci_nids	first_discovered	Startup time.
properties.zone	String	cmdb_ci_nids	zone	Zone of the IoT sensor.

Table 2. Devices attribute mapping

Payload field name	Data type	Mapped to table	Mapped to field	Description
id	String format: /subscriptions/subscription-id>/providers/<providers-id>/location/<location>/deviceGroups/<device-Group>/devices/<name-field>	sys_object_source cmdb_ot_entity cmdb_key_value_v2	snk in sys_object_source discovery_source_id in cmdb_ot_entity	Unique ID for the device.
resourceGroup	(Empty)	cmdb_key_value_v2	(Empty)	Resource group
tenantId	(Empty)	cmdb_key_value_v2	(Empty)	Tenant ID
properties.authorizedState	String	cmdb_key_value_v2	(Empty)	Authorized state of the device
properties.criticality	String	cmdb_ot_entity	business_criticality	Criticality of the device
properties.deviceName	String	cmdb_ci	name	Name of the device.
properties.deviceSubTypeDisplayName	String	cmdb_ci	sys_class_name	Device subtype display name.
properties.firstSeen	Date and time as string	cmdb_ci cmdb_ci_ot_control_module (if control modules are present)	first_discovered	First time the device was seen.
properties.lastSeen	Date and time as string	cmdb_ci cmdb_ci_ot_control_module (if control modules are present)	most_recent_discovery	Last time the device was seen.
properties.purdueLevel	String	cmdb_ot_entity	purdue_level	Purdue level of the device.
properties.operatingSystem.distribution	String	cmdb_ci_computer	os	OS distribution
properties.operatingSystem.version	String	cmdb_ci_computer	os_version	OS version
properties.operatingSystem.platform	String	cmdb_ci_computer	os_domain	OS platform
properties.operatingSystem.architecture	String	cmdb_ci_computer	os_address_width	OS architecture
properties.additionalFields.plcKeyState	(Empty)	cmdb_ci_ot_plc	switch_position	PLC key state
properties.additionalFields.plcRunState	(Empty)	cmdb_ci_ot_plc	switch_remote_mode	PLC run state
properties.hardware	Object	(Empty)	(Empty)	Device hardware data
properties.hardware.model	String	cmdb_ci	(Empty)	Hardware model
properties.hardware.serialNumber	String	cmdb_serial_number	serial_number	Hardware serial number
properties.hardware.vendor	String	cmdb_ci	manufacturer	Hardware vendor
properties.nics	Array of Objects	(Empty)	(Empty)	List of the device network interface cards.
properties.nics[{}]	Object	(Empty)	(Empty)	Network interface card properties
properties.nics[{}].ipv4Address	String	cmdb_ci_ip_address	ip_address	IPv4 address
properties.nics[{}].macAddress	String	cmdb_ci_network_adapter	name, mac	MAC Address
properties.slots	Array of Objects	(Empty)	(Empty)	List of the device slot in the backplane.
properties.slots[{}]	Object	(Empty)	(Empty)	Slot data in PLC backplane.
properties.slots[{}].firmwareVersion	String	cmdb_ci_ot_control_module	firmware_version	Firmware version of the slot.
properties.slots[{}].model	String	cmdb_ci_ot_control_module	model_id	Model of the slot.
properties.slots[{}].rackNumber	Integer	cmdb_ci_ot_control_module	rack_number	Rack number in the backplane
properties.slots[{}].serialNumber	String	cmdb_ci_ot_control_module	serial_number	Serial number of the slot.
properties.slots[{}].slotNumber	Integer	cmdb_ci_ot_control_module	slot_number	Slot number inside the rack.
properties.slots[{}].hardwareVendor	String	cmdb_ci_ot_control_module	vendor	Hardware vendor of the slot.

Table 3. Device type classification

Microsoft Azure device sub type name	Microsoft Azure device type name	Operating system/firmware	NOW class	NOW table	NOW OT type
Alarm Siren	(Empty)	(Empty)	IoT device	cmdb_ci_iot	NULL
Alarm System	(Empty)	(Empty)	OT Control System	cmdb_ci_ot_control	OT Control System
ATM	(Empty)	(Empty)	IoT device	cmdb_ci_iot	NULL
Backup Server	(Empty)	(Empty)	Server	cmdb_ci_server	NULL
Barcode Scanner	(Empty)	(Empty)	IoT device	cmdb_ci_iot	NULL
DB Server	(Empty)	(Empty)	Server	cmdb_ci_server	NULL
DCS Controller	Industrial	(Empty)	DCS	cmdb_ci_ot_dcs	NULL
Domain Controller	(Empty)	(Empty)	Server	cmdb_ci_server	NULL
Door Control Panel	(Empty)	(Empty)	IoT device	cmdb_ci_iot	NULL
DVR	(Empty)	(Empty)	IoT device	cmdb_ci_iot	NULL
Elevator	(Empty)	(Empty)	IoT device	cmdb_ci_iot	NULL
Engineering Station	Industrial	(Empty)	EWS	cmdb_ci_ot_ews	EWS
Fire Alarm	(Empty)	(Empty)	IoT device	cmdb_ci_iot	NULL
Fire Detector	(Empty)	(Empty)	IoT device	cmdb_ci_iot	NULL
Firewall	(Empty)	(Empty)	IP Firewall	cmdb_ci_ip_firewall	NULL
Game console	(Empty)	(Empty)	Game Console	cmdb_ci_game_console	NULL
Historian	(Empty)	(Empty)	Historian	cmdb_ci_ot_historian	Historian
HMI	Industrial	(Empty)	HMI	cmdb_ci_ot_hmi	HMI
Humidity Sensor	(Empty)	(Empty)	IoT device	cmdb_ci_iot	NULL
HVAC	(Empty)	(Empty)	HVAC Equipment	cmdb_ci_hvac	NULL
I/O Adapter	(Empty)	(Empty)	Network Adapter	(Empty)	NA
IED	(Empty)	(Empty)	IED	cmdb_ci_ot_ied	ied
Industrial Packaging System	(Empty)	(Empty)	OT Field Device	cmdb_ci_ot_field_device	OT Field Device
Industrial Robot	(Empty)	(Empty)	Industrial Robot	cmdb_ci_ot_industrial_robot	Industrial Robot
Industrial Scale	(Empty)	(Empty)	OT Field Device	cmdb_ci_ot_field_device	OT Field Device
Intercom	(Empty)	(Empty)	IoT device	cmdb_ci_iot	NULL
IP Camera	(Empty)	(Empty)	IP Camera	cmdb_ci_ip_camera	NULL
IP Telephone	(Empty)	(Empty)	IP phone	cmdb_ci_ip_phone	NULL
Marquee	(Empty)	(Empty)	IoT device	cmdb_ci_iot	NULL
Meter	(Empty)	(Empty)	Industrial Sensor	cmdb_ci_ot_industrial_sensor	Industrial Sensor
Motion Detector	(Empty)	(Empty)	IoT device	cmdb_ci_iot	NULL
Multicast/Broadcast	(Empty)	(Empty)	Netgear	cmdb_ci_netgear	NULL
NTP Server	(Empty)	(Empty)	Server	cmdb_ci_server	NULL
People Counter System	(Empty)	(Empty)	IoT device	cmdb_ci_iot	NULL
Physical Location	(Empty)	(Empty)	(Empty)	(Empty)	NULL
PLC	Industrial	(Empty)	PLC	cmdb_ci_ot_plc	PLC
Pneumatic Device	(Empty)	(Empty)	Industrial Actuator	cmdb_ci_ot_industrial_actuator	Industrial Actuator
Printer	(Empty)	(Empty)	Printer	cmdb_ci_printer	NULL
Protocol Converter	(Empty)	(Empty)	Netgear	cmdb_ci_netgear	NULL
Punch Clock	(Empty)	(Empty)	IoT device	cmdb_ci_iot	NULL
Robot Controller	(Empty)	(Empty)	OT Control System	cmdb_ci_ot_control	OT Control System
Router	(Empty)	(Empty)	IP Router	cmdb_ci_ip_router	NULL
RTU	(Empty)	(Empty)	RTU	cmdb_ci_ot_rtu	NULL
Server	Server	(Empty)	Server	cmdb_ci_server	NULL
Servo Drive	(Empty)	(Empty)	Industrial Actuator	cmdb_ci_ot_industrial_actuator	Industrial Actuator
Slot	(Empty)	(Empty)	OT Control Module	cmdb_ci_ot_control_module	OT Control Module
Smart Light	(Empty)	(Empty)	IoT device	cmdb_ci_iot	NULL
Smart Phone	(Empty)	(Empty)	Handheld Computing Device	cmdb_ci_handheld_computing	NULL
Smart Switch	(Empty)	(Empty)	IoT device	cmdb_ci_iot	NULL
Smart TV	(Empty)	(Empty)	Smart Television	cmdb_ci_stv	NULL
Storage	(Empty)	(Empty)	Server	cmdb_ci_server	NULL
Switch	Network Device	(Empty)	IP Switch	cmdb_ci_ip_switch	NULL
Tablet	(Empty)	(Empty)	Handheld Computing Device	cmdb_ci_handheld_computing	NULL
Terminal Station	(Empty)	(Empty)	Computer	cmdb_ci_computer	NULL
Thermostat	(Empty)	(Empty)	IoT device	cmdb_ci_iot	NULL
Turnstile	(Empty)	(Empty)	IoT device	cmdb_ci_iot
Uninterruptable Power Supply	(Empty)	(Empty)	UPS	cmdb_ci_ups	NULL
Variable Frequency Drive	(Empty)	(Empty)	Industrial Drive	cmdb_ci_ot_industrial_drive	Industrial Drive
VPN Gateway	(Empty)	(Empty)	Netgear	cmdb_ci_netgear	NULL
Wifi Pineapple	(Empty)	(Empty)	Netgear	cmdb_ci_netgear	NULL
Wireless Access Point	(Empty)	(Empty)	Wireless Access Point	cmdb_ci_wap_network	NULL
WLAN access point	Network Device	(Empty)	Wireless Access Point	cmdb_ci_wap_network	NULL
Workstation	Workstation	(Empty)	Computer	cmdb_ci_computer	NULL
Unknown	All	(Empty)	Operational Technology (OT)	cmdb_ci_ot	Operational Technology (OT)
Unclassified	Unclassified or All	(Empty)	Operational Technology (OT)	cmdb_ci_ot	Operational Technology (OT)
Any other type	(Empty)	(Empty)	Operational Technology (OT)	cmdb_ci_ot	Operational Technology (OT)
Any above type value except with designation Network and IoT	(Empty)	windows server windows server, version 2004[8] windows server, version 1909[9] windows server, version 1903[9] windows server 2019 windows server 2016 windows server 2012 r2 windows server 2012 windows server 2008 r2 windows server 2008 windows server 2003 r2 windows server 2003 windows 2000 server windows nt 4.0 server windows nt 3.51 server windows nt 3.5 server windows nt 3.1 server	Windows Server	cmdb_ci_linux_server	Same as when the operating system isn't present.
Any above type value except with designation Network and IoT	(Empty)	linux arch centos debian fedora suse red hat rhel ubuntu oracle	Linux Server	cmdb_ci_linux_server	Same as when the operating system isn't present.
Any above type value except with designation Network and IoT	(Empty)	aix	AIX Server	cmdb_ci_aix_server	Same as when the operating system isn't present.
Any above type value except with designation Network and IoT	(Empty)	esx	ESX Server	cmdb_ci_esx_server	Same as when the operating system isn't present.
Any above type value except with designation Network and IoT	(Empty)	hp/ux hpux	HP-UX Server	cmdb_ci_hpux_server	Same as when the operating system isn't present.
Any above type value except with designation Network and IoT	(Empty)	hyper-v hyperv hyper	HypverV Server	cmdb_ci_hyper_v_server	Same as when the operating system isn't present.
Any above type value except with designation Network and IoT	(Empty)	solaris sunos sun os	Solaris Server	cmdb_ci_solaris_server	Same as when the operating system isn't present.
Any above type value except with designation Network and IoT	(Empty)	macos x server macos server os x osx	OSX Server	cmdb_ci_osx_server	Same as when the operating system isn't present.
Any above type value except with designation Network and IoT	(Empty)	unix gnu	Unix Server	cmdb_ci_unix_server	Same as when the operating system isn't present.
Any above type value except with designation Network and IoT	(Empty)	win windows Microsoft windows 1.0, 1.02, 1.03, 1.04, 2.03, 2.10, 2.11, 3.0, 3.1, 3.2, 7, 8, 8.1, 10, 98, 95 windows 2000 windows for workgroups 3.11 windows me windows nt 3.1, 3.5, 3.51, 4.0 windows vista windows xp windows xp professional x64 edition	Base Computer class	cmdb_ci_computer	Same as when the operating system isn't present.
Any above type value except with designation Network and IoT	(Empty)	server	Base Server Class	cmdb_ci_server	Same as when the operating system isn't present.