Collecting Microsoft Defender Firewall Data for Azure Sentinel

Collecting Microsoft Defender Firewall Data

Prev Question Next Question

Question

You have three on-premises servers named Server1, Server2, and Server3 that run Windows. Server1 and Server2 and located on the Internal network. Server3 is located on the premises network. All servers have access to Azure.

From Azure Sentinel, you install a Windows firewall data connector.

You need to collect Microsoft Defender Firewall data from the servers for Azure Sentinel.

What should you do?

Answers

A. Create an event subscription from Server1, Server2 and Server3

B. Install the On-premises data gateway on each server.

C. Install the Microsoft Agent on each server.

D. Install the Microsoft Agent on Server1 and Server2 install the on-premises data gateway on Server3.

Show Answer

Explanations

Click on the arrows to vote for the correct answer

A. B. C. D.

https://docs.microsoft.com/en-us/azure/sentinel/connect-windows-firewall

The correct answer is D. Install the Microsoft Agent on Server1 and Server2, install the on-premises data gateway on Server3.

Explanation:

To collect Microsoft Defender Firewall data from on-premises servers, we need to use an on-premises data gateway to securely connect to Azure Sentinel.

Option A: Create an event subscription from Server1, Server2, and Server3 will not collect firewall data from the servers. Event subscription is used to send selected Azure service events to external targets such as Azure Event Hubs, Azure Service Bus, or webhooks.

Option B: Installing the on-premises data gateway on each server will work, but it is not necessary to install on all servers. It is recommended to install the on-premises data gateway on a dedicated server to manage and maintain the gateway efficiently.

Option C: Installing the Microsoft Agent on each server will not collect firewall data from the servers. The Microsoft Monitoring Agent is used to collect data from Windows servers and sends the data to Azure Monitor.

Option D: Installing the Microsoft Agent on Server1 and Server2 and the on-premises data gateway on Server3 is the correct option. The Microsoft Monitoring Agent collects the firewall data from Server1 and Server2 and sends it to the on-premises data gateway installed on Server3. The on-premises data gateway securely transfers the data to Azure Sentinel for analysis.

Therefore, Option D is the correct answer.

Prev Question Next Question