I need help understanding how/where the logs are sent to from EV from Azure ATP. We currently have MS ATP running on all our DCs which is configured to push logs to our MS ATA Console Server.
My Question is for the Azure ATP setup do I need to configure a server to host logs or are the logs seen through Azure Portal
I understand that first I must create Azure ATP instance, provide a username and PW to connect to our on-premise AD, then install and configure the Azure ATP sensors on all DCs
So would I only need to login to portal.atp.azure.com to access event viewing?
I want to confirm I do NOT need an additional server to install the ATP console
