Forum Discussion
Azure ATP syslog events - Firewall settings ???
Eli Ofek, Thanks for your feedback.
I'm not an ATP expert, but from what I've been told, there's a way to have AATP send alerts to our internal SIEM, and that goes over Internet, and it can only be an inbound connection (from our perspective)... the doc indeed talks about a 'sensor', but also mentions the FQDN, incl. port, of the 'service endpoint', i.e. the (internal) syslog server, so at some point, we'll have to open the perimeter firewall to allow that traffic, and my question is : what IPs are we supposed to allow (inbound) ?? While TLS is supported (so we could use an F5 VIP with an SSL profile to filter, but that's already behind the FW... we can't allow the whole world to get into the DMZ, even if we can use TLS to filter out potential rogue traffic...
https://docs.microsoft.com/en-us/azure-advanced-threat-protection/setting-syslog
or should I understand you reply as " syslog notifications are always sent from AATP to a sensor that is inside your network, and de facto acts as a syslog proxy" ???
