Limit Advanced Threat Protection to one domain

Question

Greetings,&nbsp;We use Azure Advanced Threat Protection outside of Azure Security Center. We view the information in a stand alone ATP area.&nbsp;We have several forests but only want to protect one.&nbsp;Does anyone know of a way to limit the scan to 1 forest?&nbsp;Thanks,&nbsp;Flynn

eliofek · Answer

FlynnKeilty&nbsp;If the forests do not have trust between them, and you only install sensors on the one you want to protect, it should work.
If you have trust, then it does not make sense to "protect just one" because you won't be if you "monitor just one". an attacker can easily attack from one of the other forests and you won't be able to see it.
&nbsp;

nonsaho · Answer

What if you have a trust with a sister company with their own MDI instance? We are getting flagged in secure score that the sensor is missing on over 130 DC which is a bit annoying. They are protecting their environment and we are protecting our environment, which generally works well.

eliofek · Answer

Nonsaho&nbsp;In this case you are both losing.
&nbsp;
Once you have trust/connected networks,&nbsp; those are not really separated entities...Attackers can move in between them freely,&nbsp;If they can, they will use a machine from company A to attack company B , they won't care that those are 2 companies...From MDI perspective/security perspective, it makes sense to protect both companies&nbsp; using a single MDI tenant.
If running like this, it will work, but you will lose detection for cross company attacks...
&nbsp;

nonsaho · Answer

Thanks for your reply. It is actually not that easy. These companies are two different legal entities and can’t come together under one MDI instance. I guess the solution is lacking this required option to exclude domains if two or more companies are responsible for their own environment. I fully understand that from a technical point of view, but the reality looks different.

eliofek · Answer

Nonsaho&nbsp;The reality is that the attacker&nbsp; won't care those are 2 separate legal entities, it might even be an advantage for the attacker...But I understand that some customers&nbsp; will prefer to have limited security due to this situation and "dismiss" the alert for specific domains.
Adding&nbsp;Or Tsemah&nbsp; from Product for this feedback.

Forum Discussion

Limit Advanced Threat Protection to one domain

7 Replies