Forum Discussion
Queries on Microsoft Azure ATP
Hi Karthik,
Azure ATP is significantly different to ATA. More information about the architecture of Azure ATP can be found here: https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-architecture
In answer to your specific questions ...
1) Can I modify the certificate used by Azure ATP to establish the secure connection between ATP portal and Sensor like in Microsoft ATA? If yes, where can I do so?
You do not need to configure a certificate to establish a secure connection between the Azure ATP service and the Sensor -- a secured HTTPS connection is automatically established when you connect the sensor to the service. Information about installing the sensor can be found here: https://docs.microsoft.com/en-us/azure-advanced-threat-protection/install-atp-step4
If you use a proxy to connect the DCs to the service, information about how to set that up can be found here: https://docs.microsoft.com/en-us/azure-advanced-threat-protection/configure-proxy
2) What is the certificate used for TLS (Secured Syslog) for Splunk integration with the Syslog server? I need to install the certificate on my Splunk for secured communication with the Dedicated Sensor.
The Azure ATP sensor does not enable you to select a specific certificate -- it checks the server certificate to ensure there are no SSL policy errors like chain errors or name mismatches.
3) What is the database used by Azure ATP? Like in Microsoft ATA, as we all know it is MongoDB. Likewise I would like to know what is used for Azure ATP? Is it the same DB?
The Azure ATP service uses a different backend database which is not accessible to customers.
4) How long are the alerts stored in the Azure ATP cloud service? When does the log/alerts start purging due to excessive logging? Incase of Microsoft ATA, the logs/alerts start purging when the dedicated storage for logging gets exhausted.
Since Azure ATP is a service, the logs/alerts are not purged int eh same way as ATA. Currently Azure ATP data is stored for at least 6 months.
5) Under the Syslog settings, if I configure one Sensor for forwarding the alerts to Splunk, will it forward only the alerts generated on that specific ATP Sensor to the Splunk or will it forward all the alerts generated on all the ATP Sensors in my domain to the Splunk?
The sensor will forward ALL alerts from your Azure ATP instance to your SIEM. Note that the alerts are generated by the Azure ATP service, not by each Sensor.
Hope that helps.
Regards,
Astrid
Hi Astrid,
Thank you for the quick and descriptive response. I have a few follow-up queries.
1) Would I be able to modify the certificate used, based on my requirement, for the Azure ATP service and ATP Sensor communication and for Syslog integration with Splunk over TLS connection?
2) I understand logs don't purged in Azure ATP, but may I know what would happen to the logs after 6 Months?
Thank you.
Hi Karthik,
1) Would I be able to modify the certificate used, based on my requirement, for the Azure ATP service and ATP Sensor communication and for Syslog integration with Splunk over TLS connection?
No, you are not able to modify the certificate for the Azure ATP Service/sensor communications - I'd be interested in understanding what your specific requirements are not met by the current secured connection (feel free to Private message me with the information if you are able to share in this forum).
You also cannot modify the syslog certificate from the Azure ATP side.
2) I understand logs don't purged in Azure ATP, but may I know what would happen to the logs after 6 Months?
Our data management policies can be found here: https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-privacy-compliance For information about Azure ATP trust and compliance, see the Service Trust portal and the Microsoft 365 Enterprise GDPR Compliance site.
Regards,
Astrid