Forum Discussion
Rizmi Razik
Jul 04, 2020Copper Contributor
Can we use Azure Monitor Gateway Server in place of Standalone Sensor Server in Azure ATP Deployment
Hi Folks, I need to know whether we can replace the Azure ATP Standalone Sensor Server with Azure Monitor - Log Analytics Gateway Server so we can connect Domain Controllers into the gateway without...
- Jul 04, 2020
Rizmi Razik No, Azure Monitor cannot be used instead of the AATP Sensor.
The normal usage of the sensor is integrated (installed on the DC itself) and does not require port mirroring, and even supports more detections.
Today about 96% of sensor deployments are integrated...
Rizmi Razik
Jul 11, 2020Copper Contributor
I am planning to implement this environment inside an ESXi host. I have attached preliminary diagram for your reference. Please verify whether ATA Gateway support mirror data coming from multiple network ports. (E.g. ATA Gatway will have three network ports and one will be used to communicate with external network and two for mirror data).
Hence, please clarify this.
EliOfek
Microsoft
Jul 11, 2020Rizmi Razik Did we switch from talking about AATP to ATA ?
Anyway, the standalone Sensor and Gateway can get mirrored traffic from several DCs at the same time, as long as each DC will be mirrored to a single port, you can split the data to multiple ports.
I can't comment on the diagram feasibility as I am not a networking engineer.
Just a few comments:
- When using AATP standalone sensor, take into account you are losing a considerable amount of detection possibilities.
- If you are really going to deploy a new ATA environment, keep in mind that ATA is switching to extended support on Jan 2021... AATP is a much better choice.