SCOM Management Pack for ATP?

[thx1200]

I can't seem to find one, but I'm wondering what the timing is for a Management Pack for ATP?  Or if there is a third party solution?  

The ATA management pack is simple, but exactly what I need.  It surfaces all alerts into the SCOM so that can be my single pane of glass.  I'd like to have that for ATP so that there is one less portal I have to check.

Any suggestions or workarounds are welcome!

EDIT: UserVoice suggestion for a SCOM MP: https://microsoftsecurity.uservoice.com/forums/905791-azure-advanced-threat-protection-ata-in-the-cl...

[#2]

Hi

We dont have a MP for Azure ATP.  The ATA MP uses events from the ATA center so that wouldn't be possible in AATP as there is not ATA center.

My recommendation would be to look at collecting syslog with SCOM.  Then have AATP send syslog to SCOM.

http://cornasdf.blogspot.com/2010/06/syslog-monitoring-walkthrough-with.html

[#3]

Oh that's a really interesting idea. I like that. I didn't realize ATP could stream syslog events. I can think of a few ways that would be useful for my monitoring story around this. Thanks for the tip.

I think that will work okay for me, but for others that may be searching and just to complete the train of thought, are there any plans for an eventual MP?

[#4]

No Plans for an MP. 

[#5]

Thanks you. Do you have any roadmap or rough timelines on when this could be coming? Also is there a highly available deployment option for the Azure ATP standalone deployment? I can see the sizing guideline but nothing about the highly availability. Does is support deployment of multiple Azure ATP standalone servers to provide high availability?

[#6]

No roadmap or timeline.  we have no plans for an AATP MP.

There is no HA option for the Sensors.

[#7]

That's really a shame.  I'll leave a suggestion on UserVoice.  

[#8]

Vote here for a AATP Management Pack for SCOM: https://microsoftsecurity.uservoice.com/forums/905791-azure-advanced-threat-protection-ata-in-the-cl...