Forum Discussion

Rizmi Razik's avatar
Rizmi Razik
MCT
Jul 04, 2020
Solved

Can we use Azure Monitor Gateway Server in place of Standalone Sensor Server in Azure ATP Deployment

Hi Folks, I need to know whether we can replace the Azure ATP Standalone Sensor Server with Azure Monitor - Log Analytics Gateway Server so we can connect Domain Controllers into the gateway without...
  • EliOfek's avatar
    EliOfek
    Jul 04, 2020

    Rizmi Razik No, Azure Monitor cannot be used instead of the AATP Sensor.

    The normal usage of the sensor is integrated (installed on the DC itself) and does not require  port mirroring, and even supports more detections.

    Today about 96% of sensor deployments are integrated...

EliOfek's avatar
EliOfek
Icon for Microsoft rankMicrosoft
Jul 04, 2020

Rizmi Razik No, Azure Monitor cannot be used instead of the AATP Sensor.

The normal usage of the sensor is integrated (installed on the DC itself) and does not require  port mirroring, and even supports more detections.

Today about 96% of sensor deployments are integrated...

  • Rizmi Razik's avatar
    Rizmi Razik
    MCT
    Jul 05, 2020

    Hi Eli,

     

    Thanks for the reply. But, in my scenario I have to avoid sensor integration to DCs directly and implement AATP standalone sensor in which there is a dedicated server installation. I wanted to whether whether we can replace this server and bring Log Analytics Gateway Server so that DCs can be directed to this and there by to Azure ATP workspace?

     

    Because, we need to see the possibility without port mirroring since our hardware (both servers, switches need to be restructured with additional equipment for making ready to uncover port mirroring). So, anything possible without port-mirroring, will be appreciated. 

     

    BR.

     

    Rizmi

    • EliOfek's avatar
      EliOfek
      Icon for Microsoft rankMicrosoft
      Jul 05, 2020

      Rizmi Razik No, those are different products collecting different information.

      You can either use the standalone version with port mirroring (and also losing some detection this way), or use the integrated option which gives you the full suite of detection.

      If none of these is a valid  option, then AATP won't work....

      Why do you have to avoid installing the sensor directly on the DC ?

      • Rizmi Razik's avatar
        Rizmi Razik
        MCT
        Jul 11, 2020

        I am planning to implement this  environment inside an ESXi host. I have attached preliminary diagram for your reference. Please verify whether ATA Gateway support mirror data coming from multiple network ports. (E.g. ATA Gatway will have three network ports and one will be used to communicate with external network and two for mirror data).

         

        Hence, please clarify this.

Resources