Daily Defender News
Aboutmerill.net
Microsoft Defender for IoT
Identity protection

Request

4 September 2026Doc update+23 / −29 lines

In brief

The documentation standardizes table separators, uses a dash for the empty vendor description cell, and updates the details field guidance and link.

What Defender admins need to know

Administrators get clearer, more consistent API reference information when consulting sensor vulnerability and risk-mitigation details.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Device fields

Name Type Nullable / Not nullable List of values
name String Not nullable -
ipAddresses JSON array Not nullable -
securityScore Numeric Not nullable -
vendor String Nullable -
firmwareVersion String Nullable -
model String Nullable -
isWirelessAccessPoint Boolean Not nullable True or False

Operating system fields

Name Type Nullable / Not nullable List of values
name String Not nullable -
type String Not nullable -
version String Nullable -

Vulnerabilities fields

Name Type Nullable / Not nullable List of values
antiViruses JSON array of strings Nullable Antivirus names
plainTextPasswords JSON array Nullable Password objects
remoteAccess JSON array Nullable Remote access objects

Password fields

Name Type Nullable / Not nullable List of values
password String Not nullable -
protocol String Not nullable -
strength String Not nullable Very weak, Weak, Medium, Strong

Remote access fields

Name Type Nullable List of values
port Numeric Not nullable -
transport String Not nullable TCP, UDP
client String Not nullable IP address

Open port fields

Name Type Nullable / Not nullable List of values
port Numeric Not nullable -
transport String Not nullable TCP or UDP
protocol String Nullable -

CVE fields

Name Type Nullable / Not nullable List of values
id String Not nullable -
score Numeric, decimal value Not nullable -
description String Not nullable -

Request

This API is called without any request parameters.

Response

unauthorizedDevices fields

Name Type Nullable / Not nullable List of values
address String Nullable IP or MAC address of the unauthorized device
name String Nullable Name of the unauthorized device
firstDetectionTime Numeric Nullable Timestamp the device was first detected, in milliseconds from Epoch time and in UTC timezone

illegalTrafficByFirewallRules fields

Name Type Nullable / Not nullable List of values
server String Nullable Server IP address
client String Nullable Client IP address
port Numeric Nullable The server port

weakFirewallRules fields

Name Type Nullable / Not nullable List of values
sources JSON array of sources Nullable JSON array of sources in any of the following formats:
- Any
- ip address (host)
- from ip-to ip (RANGE)
- ip address, subnet mask (NETWORK)
destinations JSON array of destinations Nullable JSON array of destination objects, in any of the following formats:
- Any
- ip address (host)
- from ip-to ip (RANGE)
- ip address, subnet mask (NETWORK)
ports JSON array of ports Nullable JSON array of port objects, in any of the following formats:
- Any
- port (protocol, if detected)
- from port-to port (protocol, if detected)

accessPoints fields

Name Type Nullable / Not nullable List of values
macAddress String Nullable The access point's MAC address
vendor String Nullable The access point's vendor name
ipAddress String Nullable The access point's IP address, or N/A

connectionsBetweenSubnets fields

Name Type Nullable / Not nullable List of values
server String Nullable The server's IP address
client String Nullable The client's IP address

industrialMalwareIndicators fields

Name Type Nullable / Not nullable List of values
detectionTime Numeric Nullable Timestamp the malware was first detected, in milliseconds from Epoch time and in UTC timezone
alertMessage String Nullable The alert message sent
description String Nullable The alert message description

internetConnections fields

Name Type Nullable / Not nullable List of values
internalAddress String Nullable The connection's internal IP address
authorized Boolean Nullable Yes or No
externalAddresses JSON array Not nullable A JSON array of the connection's external IP addresses

Request

This API is called without any request parameters.

Response

Type: JSON representation of one or more data tables, each with specific and potentially different structures.

The response is displayed in a map view, which maps table titles to table rows. Rows are represented as a list of objects with the same structures.

backupServer result fields

Name Type Nullable / Not nullable List of values
source String Nullable The source IP address
destination String Nullable The destination IP address
port Numeric Nullable The backup server port
backupMaximalInterval String Nullable The maximum interval time between backups
lastSeenBackup Numeric Nullable Timestamp that a backup was last seen, in milliseconds from Epoch time and in UTC timezone

ipNetworks result fields

Name Type Nullable / Not nullable List of values
addresses Numeric Not nullable The number of IP addresses discovered in the subnet range.
network String Not nullable The subnet base IP address.
mask String Not nullable The subnet mask.

protocolProblems result fields

Name Type Nullable / Not nullable List of values
protocol String Not nullable A protocol for which a protocol violation alert was triggered
addresses JSON array of IP addresses Not nullable JSON array of IP addresses where the violation originated
alert String Not nullable The title of the alert triggered

protocolDataVolumes result fields

Name Type Nullable / Not nullable List of values
protocol String Nullable A protocol that was detected on the network by the OT network sensor
volume String Nullable The volume of protocol packets captured by the OT network sensor, in MB

disconnections result fields

Name Type Nullable / Not nullable List of values
assetAddress String Nullable The IP address of the disconnected asset
assetName String Nullable The name of the disconnected asset
lastDetectionTime Numeric Nullable Timestamp that the disconnect was last detected, in milliseconds from Epoch time and in UTC timezone

Response fields

| Field name | Type | Nullable | List of values | |-| ---| --- | ---|--| | notifications | JSON array of strings | Not nullable | Recommended mitigation steps for detected vulnerabilities | | mitigation | JSON array | Not nullable | mitigation objects |

mitigation fields

| Field name | Type | Nullable | List of values | |-| ---| --- | ---|--| | content | String | Not nullable | Recommended mitigation steps for detected vulnerabilities | | scoreImprovement | Integer | Nullable | Expected percentage of security improvement after mitigation steps are taken. | | details | Table | Nullable | A table listing mitigation recommendations, such as would be generated in the Risk assessment report. Each recommendation includes details about possible security impact if the action is performed and more. For more information, see Risk mitigationCreate risk assessment reports in Microsoft Defender for IoT. |

Response example