MicrosoftFirst, I am an end user trying to make sense of all of this.
Most of the comments on this post regard licensing the product. I have had this product, in some form or another, for nearly a year. The product is continually evolving. Licensing is constantly changing. Even the "free pre-release / trial" licensing information regarding what these products will cost has been changing frequently.
It is worth noting that there is Microsoft Advanced Threat Protection (Windows Defender ATP), Office 365 Advanced Threat Protection and Azure Advanced Threat Protection. While these are related, they are different products each with different licensing. These are available through many varied licensing options. There is also Microsoft Advanced Threat Analytics as well as Azure Advanced Threat Analytics. These are similar but different products with different licensing options available.
From my Office 365 portal I have the ability to license a number of these products in a number of different ways. Some of these licenses entitle me to use the Azure and Microsoft branded products as well. Some do not. When I log into my Azure portal, I am given different options for licensing these products. As I have migrated my account from OMS to Log Analytics, I have different pricing available to me than I would have had I not. As I have created different accounts for different services and then linked them together within Azure, I have more flexible pricing options. For example, I have Microsoft ATA licensed on a separate account with no payment on file, in trial mode. The cost of this product for my network would be substantial after the trial expires. This separation allows integration without any surprise licensing costs. I have ATP in separate accounts and only installed on a small percentage of workstations. I have a pay as you go account with a pay-per-client and pay-per Azure usage license in use. Part of my trial has expired, though many products in this account remain in pre-release. I am able to put spending limits on this account so that there are no surprises when the pre-release trials begin to go paid-for. If I am satisfied with these products when they all become licensed products then I would likely add them to my existing EA E3 license.
While the licensing is very confusing, it grants us users a lot of flexibility. While historically I have not been a proponent of Microsoft security products, nor even the operating systems, times do change. The current offerings are indicative of Microsoft as a major InfoSec market disruptor. It appears that in the future, Windows will provide the antivirus (Security Center) which may be extended by 3rd party feature add-ons using a limited set of controlled APIs (versus low level 3rd party system hooks).
https://docs.microsoft.com/en-us/azure-advanced-threat-protection/what-is-atp
https://docs.microsoft.com/en-us/office365/securitycompliance/office-365-atp
Oh, I forgot, the entire reason I hit the reply button. The OMSGateway is great. I am running the latest greatest version released as of 8/2018. Which includes multi-home support. The one problem I run into which I would love it it were easier to address is this: the FQDNs that the clients connecting through the OMSGateway utilize continue to change. I must keep an eye on this and manually update each OMSGateway or communications to the FQDN fails via the OMSGateway. While some products will attempt additional connections and either connect directly or via a FQDN already allowed, some products simply quit communicating for many days.
I would like for there to be some sort of aggregated feed of required FQDNs for various products and to be given the option to approve specific feeds. ATA, ATP, OMS, WER, Telematics..... Once I give the gateway the go-ahead, I'd prefer it manage itself. I understand not everyone will agree, thus this should be an optional setting.
Thank you for your consideration.
