Quick Sizing Tool Sapio
Often defrosting tray with red silicone border largest size quick thaw frozen food rapidly and safely fda approved keto paleo atkins tool shops will be sending out daily, regular news letters with unique product sales, discounts and offers. If you want to save money, you might be able to score some good offers on items you would purchase anyway.
-->In this quickstart, you determine how many Azure ATP sensors and standalone sensors you need.
Prerequisites
- Download the Azure ATP Sizing Tool.
- Review the Azure ATP architecture article.
- Review the Azure ATP prerequisites article.
Use the sizing tool
The recommended and simplest way to determine capacity for your Azure ATP deployment is to use the Azure ATP Sizing Tool. If you're unable to use the tool, you can manually gather traffic information. For more information the manual method, see the Domain controller traffic estimator section at the bottom of this article.
Run the Azure ATP Sizing Tool, TriSizingTool.exe, from the zip file you downloaded.
When the tool finishes running, open the Excel file results.
In the Excel file, locate and click on the Azure ATP Summary sheet. The other sheet isn't needed since it's for Azure ATA planning.
Locate the Busy Packets/sec field in the Azure ATP sensor table in the results Excel file and make a note of it.
Choose your sensor type. Use the information in the Choosing the right sensor type section to determine which sensor or sensors you would like to use. Keep your Busy Packets/sec in mind when choosing the sensor type.
Match your Busy Packets/sec field to the PACKETS PER SECOND field in the Azure ATP sensor table section of this article. Use the fields to determine the memory and CPU that will be used by the sensor.
Choosing the right sensor type for your deployment
In an Azure ATP deployment any combination of the Azure ATP sensor types is supported:
- Only Azure ATP sensors
- Only Azure ATP standalone sensors
- A combination of both
When deciding the sensor deployment type, consider the following benefits:
| Sensor type | Benefits | Cost | Deployment topology | Domain controller use |
|---|---|---|---|---|
| Azure ATP sensor | Doesn't require a dedicated server and port-mirroring configuration | Lower | Installed on the domain controller | Supports up to 100,000 packets per second |
| Azure ATP standalone sensor | The out of band deployment makes it harder for attackers to discover Azure ATP is present | Higher | Installed alongside the domain controller (out of band) | Supports up to 100,000 packets per second |
Consider the following issues when deciding how many Azure ATP standalone sensors to deploy:
Active Directory forests and domains - Azure ATP can monitor traffic from multiple domains within multiple Active Directory forests, for each Azure ATP instance you create.
Port Mirroring - Port mirroring considerations might require you to deploy multiple Azure ATP standalone sensors per data center or branch site.
Capacity - An Azure ATP standalone sensor can support monitoring multiple domain controllers, depending on the amount of network traffic of the domain controllers being monitored.
Azure ATP sensor and standalone sensor sizing
An Azure ATP sensor can support the monitoring of a domain controller based on the amount of network traffic the domain controller generates. The following table is an estimate. The final amount that the sensor parses is dependent on the amount of traffic and the distribution of traffic.
The following CPU and memory capacity refers to the sensor's own consumption, not the domain controller capacity.
| Packets per second* | CPU (cores) | Memory (GB) |
|---|---|---|
| 0-1k | 0.25 | 2.50 |
| 1k-5k | 0.75 | 6.00 |
| 5k-10k | 1.00 | 6.50 |
| 10k-20k | 2.00 | 9.00 |
| 20k-50k | 3.50 | 9.50 |
| 50k-75k | 3.50 | 9.50 |
| 75k-100k | 3.50 | 9.50 |
When determining sizing, note the following items:
- Total number of cores that the sensor service will use.
It's recommended that you don't work with hyper-threaded cores. - Total amount of memory that the sensor service will use.
- If the domain controller doesn't have the resources required by the Azure ATP sensor, domain controller performance isn't affected. However, the Azure ATP sensor might not operate as expected.
- When running as a virtual machine, dynamic memory or any other memory ballooning feature isn't supported.
- For optimal performance, set the Power Option of the Azure ATP sensor to High Performance.
- A minimum of 2 cores is required. A minimum of 6 GB of space is required, 10 GB is recommended, including space needed for the Azure ATP binaries and logs.
Domain controller traffic estimation
If for some reason you can't use the Azure ATP Sizing Tool, manually gather the packet/sec counter information from all your domain controllers. Gather the information for 24 hours with a low collection interval, approximately 5 seconds. Then, for each domain controller, calculate the daily average and the busiest period (15 minutes) average. The following sections present the instruction for how to collect the packets/sec counter from one domain controller.
There are various tools that you can use to discover the average packets per second of your domain controllers. If you don't have any tools that track this counter, you can use Performance Monitor to gather the required information.
To determine packets per second, do the following steps on each domain controller:
Open Performance Monitor.
Expand Data Collector Sets.
Right click User Defined and select New > Data Collector Set.
Enter a name for the collector set and select Create Manually (Advanced).
Under What type of data do you want to include? select Create data logs, and Performance counter.
Under Which performance counters would you like to log, click Add.
Expand Network Adapter and select Packets/sec and select the proper instance. If you aren't sure, you can select <All instances> and click Add and OK.
Note
To perform this operation in a command line, run
ipconfig /allto see the name of the adapter and configuration.Change the Sample interval to five seconds.
Set the location where you want the data to be saved.
Under Create the data collector set, select Start this data collector set now, and click Finish.
You should now see the data collector set you created with a green triangle indicating that it's working.
After 24 hours, stop the data collector set, by right-clicking the data collector set and selecting Stop.
In File Explorer, browse to the folder where the .blg file was saved and double-click it to open it in Performance Monitor.
Select the Packets/sec counter, and record the average and maximum values.
Next steps
Quick Sizing Tool Sapio Art
In this quickstart, you determined how many Azure ATP sensors and standalone sensors you need. You also determined sizing for the sensors. Continue to the next quickstart to create an Azure ATP instance.
Quick Sizing Tool Sapio Tool
Join the Community
Quick Sizing Tool Sapio 2
Have more questions, or an interest in discussing Azure ATP and related security with others? Join the Azure ATP Community today!