Forum Discussion
Azure ATP syslog events - Firewall settings ???
MicrosoftPhilippeA No syslogs are sent from Azure directly to the Intranet.
In the AATP portal, you need to designate one sensor to be the syslog sender,
and this sensor will send the syslog messages to your syslog reciever.
hopefully there are both withing the same network, and don't need to cross network bounds.
And you only need the syslog port open between the designated sensor and the syslog reciever.
The designated sensor pulls the data from the backend and then send it.
Eli Ofek, Thanks for your feedback.
I'm not an ATP expert, but from what I've been told, there's a way to have AATP send alerts to our internal SIEM, and that goes over Internet, and it can only be an inbound connection (from our perspective)... the doc indeed talks about a 'sensor', but also mentions the FQDN, incl. port, of the 'service endpoint', i.e. the (internal) syslog server, so at some point, we'll have to open the perimeter firewall to allow that traffic, and my question is : what IPs are we supposed to allow (inbound) ?? While TLS is supported (so we could use an F5 VIP with an SSL profile to filter, but that's already behind the FW... we can't allow the whole world to get into the DMZ, even if we can use TLS to filter out potential rogue traffic...
https://docs.microsoft.com/en-us/azure-advanced-threat-protection/setting-syslog
or should I understand you reply as " syslog notifications are always sent from AATP to a sensor that is inside your network, and de facto acts as a syslog proxy" ???
- EliOfek
No internet is involved in syslog transport.
in the doc linked , the sensor is the designated sensor you chose to send the syslog messages in your internal network (the sensor itself will pull data from the backend, via it's normal channel).
The service endpoint is the FQDN+port of your SIEM / Syslog server/receiver.
I
