Forum Discussion

Rizmi Razik's avatar
Rizmi Razik
Copper Contributor
Jul 04, 2020
Solved

Can we use Azure Monitor Gateway Server in place of Standalone Sensor Server in Azure ATP Deployment

Hi Folks,

I need to know whether we can replace the Azure ATP Standalone Sensor Server with Azure Monitor - Log Analytics Gateway Server so we can connect Domain Controllers into the gateway without port-mirroring.

 

Because, we need to know a deployment scenario without port-mirroring. 

 

Please confrm..

  • Rizmi Razik No, Azure Monitor cannot be used instead of the AATP Sensor.

    The normal usage of the sensor is integrated (installed on the DC itself) and does not require  port mirroring, and even supports more detections.

    Today about 96% of sensor deployments are integrated...

5 Replies

  • Rizmi Razik No, Azure Monitor cannot be used instead of the AATP Sensor.

    The normal usage of the sensor is integrated (installed on the DC itself) and does not require  port mirroring, and even supports more detections.

    Today about 96% of sensor deployments are integrated...

    • Rizmi Razik's avatar
      Rizmi Razik
      Copper Contributor

      Hi Eli,

       

      Thanks for the reply. But, in my scenario I have to avoid sensor integration to DCs directly and implement AATP standalone sensor in which there is a dedicated server installation. I wanted to whether whether we can replace this server and bring Log Analytics Gateway Server so that DCs can be directed to this and there by to Azure ATP workspace?

       

      Because, we need to see the possibility without port mirroring since our hardware (both servers, switches need to be restructured with additional equipment for making ready to uncover port mirroring). So, anything possible without port-mirroring, will be appreciated. 

       

      BR.

       

      Rizmi

      • EliOfek's avatar
        EliOfek
        Icon for Microsoft rankMicrosoft

        Rizmi Razik No, those are different products collecting different information.

        You can either use the standalone version with port mirroring (and also losing some detection this way), or use the integrated option which gives you the full suite of detection.

        If none of these is a valid  option, then AATP won't work....

        Why do you have to avoid installing the sensor directly on the DC ?

Resources