Can we use Azure Monitor Gateway Server in place of Standalone Sensor Server in Azure ATP Deployment

[Rizmi Razik]

Hi Folks,

I need to know whether we can replace the Azure ATP Standalone Sensor Server with Azure Monitor - Log Analytics Gateway Server so we can connect Domain Controllers into the gateway without port-mirroring.

Because, we need to know a deployment scenario without port-mirroring. 

Please confrm..

[#2 · Accepted solution]

@Rizmi Razik No, Azure Monitor cannot be used instead of the AATP Sensor.

The normal usage of the sensor is integrated (installed on the DC itself) and does not require  port mirroring, and even supports more detections.

Today about 96% of sensor deployments are integrated...

[#3]

Hi Eli,

Thanks for the reply. But, in my scenario I have to avoid sensor integration to DCs directly and implement AATP standalone sensor in which there is a dedicated server installation. I wanted to whether whether we can replace this server and bring Log Analytics Gateway Server so that DCs can be directed to this and there by to Azure ATP workspace?

Because, we need to see the possibility without port mirroring since our hardware (both servers, switches need to be restructured with additional equipment for making ready to uncover port mirroring). So, anything possible without port-mirroring, will be appreciated. 

BR.

Rizmi

[#4]

@Rizmi Razik No, those are different products collecting different information.

You can either use the standalone version with port mirroring (and also losing some detection this way), or use the integrated option which gives you the full suite of detection.

If none of these is a valid  option, then AATP won't work....

Why do you have to avoid installing the sensor directly on the DC ?

[#5]

I am planning to implement this  environment inside an ESXi host. I have attached preliminary diagram for your reference. Please verify whether ATA Gateway support mirror data coming from multiple network ports. (E.g. ATA Gatway will have three network ports and one will be used to communicate with external network and two for mirror data).

Hence, please clarify this.

[#6]

@Rizmi Razik Did we switch from talking about AATP to ATA ?

Anyway, the standalone Sensor and Gateway can get mirrored traffic from several DCs at the same time, as long as each DC will be mirrored to a single port, you can split the data to multiple ports.

I can't comment on the diagram feasibility as I am not a networking engineer.

Just a few comments:

- When using AATP standalone sensor, take into account you are losing a considerable amount of detection possibilities.

- If you are really going to deploy a new ATA environment, keep in mind that ATA is switching to extended support on Jan 2021... AATP is a much better choice.