Azure ATP sensor proxy setting location

Hi I'm looking for a way to inventory proxy setting on all deployed ATP sensor. I tried unsuccessfully to find proxy setting location on a DC using proxy. (Used Resource monitor/network to confirm...

Or Tsemah

Former Employee

Sep 27, 2020

duckjibe

Hi, can you please tell us more about this ask, such as

If we to expose the current proxy configuration per sensor, where would you expect to see it?
What would you do with that information if you got it beside inventory?

Or.

duckjibe

Copper Contributor

Oct 12, 2020

Or Tsemah

Hi , sorry for my late answer

I need this information to document all Tier 0 components and network flows to improve firewall filtering. Also need to debug sensor issue and improve network connection disponibilty to AATP.

It will nice to be able to display it on the DC like the WDATP control panel ou any other way.

Another place is to add a column in the Configuration/sensors web page status and in the "Domain Controller Coverage" excel report.

In the mean time, I use this script:

$proxyPort = 8080
$procID = (get-process -name "Microsoft.Tri.Sensor").id
$tcpconnection = Get-NetTCPConnection -OwningProcess $procID -RemotePort $proxyPort
$tcpconnection | select-object remoteAddress -unique

Regards

Or Tsemah
Former Employee
Oct 12, 2020
duckjibe Got it, thanks

Added this as a feature request to our backlog, will update when\if we have a committed date for it.

Forum Discussion

Azure ATP sensor proxy setting location

Resources