AWS IoT Device Defender Features
What is AWS IoT Device Defender?
AWS IoT Device Defender is a fully managed service for auditing and monitoring devices connected to AWS IoT. It assesses the cloud configuration of your IoT device fleet, provides ongoing monitoring of device activities via rule-based and ML-based Detect capabilities, triggers an alarm when an audit violation or behavior anomaly is identified, and enables you to address issues quickly with built-in mitigation actions.
Audit
AWS IoT Device Defender audits your device-related resources (such as X.509 certificates, IoT policies, and Client IDs) against AWS IoT security best practices (for example, the principle of least privilege or unique identity per device). AWS IoT Device Defender reports configurations that are out of compliance with security best practices, such as multiple devices using the same identity, or overly permissive policies that can allow one device to read and update data for many other devices.
Rules Detect
AWS IoT Device Defender detects unusual device behaviors that may be indicative of a compromise by continuously monitoring high-value security metrics from the device and AWS IoT Core (e.g., the number of listening TCP ports on your devices or authorization failure counts). You can specify normal device behavior for a group of devices by setting up behaviors (rules) for these metrics. AWS IoT Device Defender monitors and evaluates each datapoint reported for these metrics against user-defined behavior (rules) and alerts you if an anomaly is detected.