Forum Discussion

Alex Verboon's avatar
Jan 03, 2019
Solved

Azure ATP connection closed errors

Hello, 

 

I just deployed Azure ATP in a fresh demo environment. No errors during installation, also when I search for computers or users I do get details, however when I try to trigger an alert by running nslookup -ls -d or run mimikatz, I don't get any alerts in Azure ATP. 

 

The Sensor is installed on a domain controller server 2016 standard , sensor agent version is

2.59.6040.997

 

The domain controller runs in hyper-v and has two nics, one uses the default switch and the other is a private network for the lab. 

 

The Microsoft.Tri.Sensor-Errors log file contains the following errors. 

 

2019-01-03 17:38:50.3349 Error ExceptionDispatchInfo System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.WebException: The underlying connection was closed: A connection that was expected to be kept alive was closed by the server. ---> System.IO.IOException: Unable to read data from the transport connection: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. ---> System.Net.Sockets.SocketException: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond
   at int System.Net.Sockets.Socket.EndReceive(IAsyncResult asyncResult)
   at int System.Net.Sockets.NetworkStream.EndRead(IAsyncResult asyncResult)
   --- End of inner exception stack trace ---
   at int System.Net.Security._SslStream.EndRead(IAsyncResult asyncResult)
   at int System.Net.TlsStream.EndRead(IAsyncResult asyncResult)
   at void System.Net.Connection.ReadCallback(IAsyncResult asyncResult)
   --- End of inner exception stack trace ---
   at WebResponse System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
   at void System.Net.Http.HttpClientHandler.GetResponseCallback(IAsyncResult ar)
   --- End of inner exception stack trace ---
   at async Task<HttpResponseMessage> System.Net.Http.HttpClient.FinishSendAsyncBuffered(Task<HttpResponseMessage> sendTask, HttpRequestMessage request, CancellationTokenSource cts, bool disposeCts)
   at async Task<TResponse> Microsoft.Tri.Common.CommunicationWebClient.SendAsync<TResponse>(byte[] requestBytes, int offset, int count)
   at async Task<TResponse> Microsoft.Tri.Common.CommunicationWebClient.SendAsync<TResponse>(IRequestWithResponse<TResponse> request)
   at async Task<TResponse> Microsoft.Tri.Sensor.Common.ServiceProxy<TWebClientConfiguration>.SendAsync<TResponse>(IRequestWithResponse<TResponse> request)
   at async Task Microsoft.Tri.Sensor.EntitySender.SendEntityBatchAsync(EntityBatch entityBatch, EntityBatch postponedEntityBatch)
   at async Task Microsoft.Tri.Sensor.EntitySender.SendEntityBatchesAsync()

 

Any hints where to look wuld be appreciated. 

  • Eli Shlomo's avatar
    Eli Shlomo
    Jan 06, 2019

    you can work with a demo environment without any issues.

    back to the log, you've some error with: the underlying connection was closed... and that means you've some issue with a connection from your local DC's to the AATP, it could be a connectivity issue, some SSL inspection or even firewall port.

     

     

8 Replies

  • from the tri logs, it looks like the sensor isn't stable and restarting, below a few points to check:

     

    Make sure Azure ATP Prerequisites is

    Did you saw outbound connection limit or network issues from DC's to AATP

    Make sure your DC's are healthy and connected (on AATP console)

    Do you've some SSL inspection or proxy to the internet?

     

    To simulate an attack scenario with AATP, it will be better with two Windows client (one victim and one attacker).

    • Alex Verboon's avatar
      Alex Verboon
      MVP

      Hi and thanks for your reply, I have checked all prerequisites. 

       

      1. server is helathy

      2. No Sensor errors in ATP portal

      3. Sensor is listed

       

      I deleted the ATP instance and created one from scratch.  however when I try to connect: https://m365x727487sensorapi.atp.azure.com/

       

      Note: m365x727487 is the name of my demo tenannt, i get 

      HTTP Error 503. The service is unavailable.

       

      After I have setup the instance, I can browser domain specific objects, so it looks like some information is flowing up correctly. 

       

       

       

       

       

       

      • EliOfek's avatar
        EliOfek
        Icon for Microsoft rankMicrosoft

        503 is normal when using a browser.

        Something is blocking the connection.

        Notice that the services are running under local service & local system,

        so they might be getting a different policy compared to your logged in user...

        Any chance they are getting some proxy settings via policy that keeps blocking it ?

Resources