Forum Discussion
Azure ATP Sensor tries to connect to public IPs
After installing Azure ATP Sensor on a domain controller for testing, I see a number of failed connection attempt to external IPs (specifically our public DNS IPs) on ports 3389, 135, 137 from that domain controller.
Ticket# 119080724001601
13 Replies
- If we block outbound traffic from the domain controllers to ports 135, 137, & 3389 to our public DNS resolvers, will this cause an issue or generate any alerts for the Azure ATP sensor. We're looking to harden firewall traffic and only permit 53 outbound from the DC to trusted DNS servers.
- EliOfek
Microsoft
AzureGuineaPig As long as the FW will refuse connection immediately and not act as a sink hole it should be fine.
This is expected communication and is part of the NNR process AATP uses to resolve the IP address in the network traffic to a computer name.
https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-prerequisites#ports
https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-nnr-policy
Best
Gershon
Gerson Levitz this makes sense for private IPs, i don't see why it would try to connect public IPs. that also generates a lot of noise on our firewalls / SIEM. it would be ideal to be able to select the IP ranges that i would want the agent to interrogate for this additional info.
