Forum Discussion
Can we use Azure Monitor Gateway Server in place of Standalone Sensor Server in Azure ATP Deployment
Hi Folks,
I need to know whether we can replace the Azure ATP Standalone Sensor Server with Azure Monitor - Log Analytics Gateway Server so we can connect Domain Controllers into the gateway without port-mirroring.
Because, we need to know a deployment scenario without port-mirroring.
Please confrm..
Rizmi Razik No, Azure Monitor cannot be used instead of the AATP Sensor.
The normal usage of the sensor is integrated (installed on the DC itself) and does not require port mirroring, and even supports more detections.
Today about 96% of sensor deployments are integrated...
5 Replies
- EliOfek
Microsoft
Rizmi Razik No, Azure Monitor cannot be used instead of the AATP Sensor.
The normal usage of the sensor is integrated (installed on the DC itself) and does not require port mirroring, and even supports more detections.
Today about 96% of sensor deployments are integrated...
Hi Eli,
Thanks for the reply. But, in my scenario I have to avoid sensor integration to DCs directly and implement AATP standalone sensor in which there is a dedicated server installation. I wanted to whether whether we can replace this server and bring Log Analytics Gateway Server so that DCs can be directed to this and there by to Azure ATP workspace?
Because, we need to see the possibility without port mirroring since our hardware (both servers, switches need to be restructured with additional equipment for making ready to uncover port mirroring). So, anything possible without port-mirroring, will be appreciated.
BR.
Rizmi
- EliOfek
Rizmi Razik No, those are different products collecting different information.
You can either use the standalone version with port mirroring (and also losing some detection this way), or use the integrated option which gives you the full suite of detection.
If none of these is a valid option, then AATP won't work....
Why do you have to avoid installing the sensor directly on the DC ?
