Top 7 Network TAPs for Microsoft Sentinel Deployments

Microsoft Sentinel only sees what your sensors send it. For network detection, those sensors need a complete copy of live traffic.

That copy comes from either a SPAN port or a network TAP. SPAN is convenient, but it drops packets under load. Worse, it fails silently. A packet that never reaches a sensor never becomes a log, an alert or an incident.

Microsoft's own Defender for IoT guidance names the TAP as the best method for forensic monitoring. So your TAP layer sets the ceiling on what Sentinel can detect.

This guide compares seven vendors whose TAPs and packet brokers feed Sentinel-connected sensors. Those sensors include Defender for IoT, Corelight and Darktrace. Each entry covers products, speeds and how the vendor fits a Sentinel architecture.

At a Glance: Network TAPs for Microsoft Sentinel

1. Network Critical

Network Critical builds the physical capture layer that sits beneath Sentinel-connected sensors. Its passive fiber taps need no power and cover 1G to 100G. They pass full-duplex traffic, including errors, to sensors such as Defender for IoT or Corelight.

The SmartNA-XL combines TAP modules and packet broker functions in a single 1RU chassis. It handles copper and fibre links from 1G to 40G. Packet slicing and payload masking trim what each sensor receives.

For core links, the 100gb smartna portplus scales from 48 to 194 ports at 1G to 100G. It runs at 1.8 Tbps line rate in a non-blocking architecture. The SmartNA-PortPlus HyperCore extends this to 400G with 32 QSFP-DD interfaces.

Drag-n-Vu lets network admins build filters and port maps by drag and drop. Its Open API supports fully automated configuration. One-Click Rollback restores earlier settings during a change window.

Output is standard traffic, not a proprietary format. The same TAP layer can feed Sentinel-connected sensors and any other tool you choose.

Best for: Hybrid estates that need full-fidelity traffic for Sentinel-connected sensors without subscription lock-in.

Proven results:

• Bourne Leisure: SmartNA-XL connected eight 1G live links to one 10G security tool at each data centre.
• Darktrace: The SmartNA-PortPlus API lets Darktrace change filters and port maps with no human intervention.
• HSBC: Passive fibre TAPs delivered zero-latency monitoring with zero network impact, from the UK to Hong Kong.

2. Gigamon

Gigamon pairs G-TAP passive optical TAPs with its GigaVUE visibility nodes. The G-TAP M Series modules are fully passive. They never need power, software or configuration. Gigamon's TAP portfolio covers fibre links from 1G to 400G.

Gigamon has the most direct Sentinel integration in this list. It integrated its Deep Observability Pipeline with Microsoft Sentinel in October 2024. In the same announcement, it joined the Microsoft Intelligent Security Association (MISA).

The Application Metadata Exporter (AMX) converts Application Metadata Intelligence output into JSON. It then sends that data to Sentinel through a dedicated connector, landing in the Gigamon_CL table. AMX runs on a V Series node managed by GigaVUE-FM. It supports VMware, AWS and Azure environments.

Gigamon also covers cloud, container and encrypted traffic visibility. That breadth suits large enterprises with heavy hybrid cloud footprints. Much of the GigaVUE software is sold on subscription. Factor renewal costs into multi-year Sentinel budgets alongside your log ingestion spend.

3. Keysight

Keysight's network visibility business is built on the Ixia acquisition. Its Flex Tap family offers fully passive fibre TAPs tested from 1G to 400G. The Flex Tap VHD fits up to 36 TAPs in a single 1U rack space.

Flex Taps have no IP address and need no power. That removes them as a remote attack surface. Split ratios range from 50/50 to 90/10 across single-mode and multimode models.

Keysight has a specific Defender for IoT link. Microsoft lists the IXIA TPA2-CU3 copper TAP among models tested for compatibility. Microsoft's guidance says to enable aggregation mode when using it.

For brokering, the Vision 400 Series supports deduplication, header stripping and packet trimming for core monitoring. Its drag-and-drop interface removes the need for REGEX or CLI rules. Vision 400 won a Frost and Sullivan 2024 Global New Product Innovation Award.

Keysight added an OT partnership with Forescout in January 2026. Pricing sits at the premium end of the market.

4. Garland Technology

Garland Technology is a US-based TAP specialist with a strong OT focus. Its range covers passive and aggregator TAPs, packet brokers, data diodes and inline bypass.

Garland has a clear Defender for IoT reference point. Microsoft lists the Garland P1GCCAS aggregator copper TAP as tested for compatibility. Microsoft advises configuring the network to support aggregation when deploying it.

Garland's passive fibre TAPs support 1G to 400G. High-density models fit 28 or 56 TAPs in 1U. Split ratio options run from 50/50 to 90/10, with custom ratios available.

Its OT security partner ecosystem includes Nozomi Networks, TXOne and Dispel. Nozomi Networks also appears in Microsoft's list of Sentinel data connectors. That gives OT teams a documented path from TAP to sensor to SIEM.

Garland states plainly that it charges no subscriptions and no hidden fees. Its advanced packet broker features are narrower than larger platforms. European coverage relies mainly on distributors. Garland also publishes regular guidance on TAP versus SPAN, NIS2 and IEC 62443 deployments.

5. Arista Networks

Arista's DANZ Monitoring Fabric (DMF) is a controller-driven packet broker built on Arista switching. It uses a scale-out leaf-spine design, so you add capacity as you grow. Arista positions its TAP aggregation for non-blocking 1G to 400G networks.

DMF centralises tool farms into one logical packet broker. Multiple teams can share it as monitoring-as-a-service. The DMF Recorder Node adds packet recording for investigations.

Arista documents deploying the DMF Controller in Microsoft Azure. That matters for teams standardising their security tooling on Microsoft infrastructure.

DMF delivers most value where Arista is already the switching vendor. It depends on Arista or approved merchant-silicon hardware. Organisations with mixed switching estates should weigh that dependency carefully.

Arista offers a DMF Labs online environment for hands-on evaluation without shipping hardware. That shortens proof-of-concept cycles for Sentinel architecture planning. Pricing follows Arista's enterprise model and often includes switching hardware in the deal.

6. APCON

APCON is a packet broker specialist based in Wilsonville, Oregon. Its IntellaView platform supports 1G to 400G in chassis sizes from 1RU to 9RU. Passive optical TAPs sit alongside the broker range.

In February 2026, APCON launched IntellaStore IV. It combines visibility, packet capture and an on-box APCON Intelligent Processor. The processor runs your choice of security applications, including APCON's own ThreatGuard. Each unit includes a 60-day ThreatGuard trial.

IntellaView Enterprise manages fleets of APCON switches from one console. It handles configuration, backups, firmware and scheduled health checks.

APCON's compliance features include data masking and packet slicing. These help when sensors feed a SIEM that must avoid storing sensitive payloads.

APCON publishes per-switch licensing with no hidden fees. Pricing itself is quote-based through partners. Its brand footprint is smaller than the enterprise incumbents. The on-box security model is also newer, with less scaled customer proof in public sources.

7. Profitap

Profitap is a Netherlands-based vendor with strong European field presence. Its passive fibre TAPs cover 1G to 400G with no power required.

At the high end, the X2-12800G packet broker offers 32 x 400G QSFP-DD ports. Profitap's broker features include deduplication, slicing, tunnelling and data masking. Supervisor manages XX-Series and X2-Series brokers centrally.

The IOTA line combines capture, storage and analysis in one appliance. That suits teams that want packet evidence close to the sensor. It is less flexible for separating capture from analysis across a large fabric.

Profitap also lists cloud visibility options for Azure VM, Kubernetes and VMware. For Sentinel teams with Azure workloads, that may simplify a mixed physical and virtual design.

Profitap's ProfiShark portable capture devices add field troubleshooting for remote sites. North American coverage is lighter than other vendors here. Its 400G positioning is newer than the large incumbents.

How to Choose the Right Network TAPs for Your Microsoft Sentinel Deployment

Start With the Sensors, Not the SIEM

Sentinel ingests logs and alerts, not raw packets. Your TAPs feed sensors that analyse traffic and forward results. List every sensor first:

• Microsoft Defender for IoT OT sensors
• Corelight sensors exporting Zeek and Suricata events
• Darktrace masters pushing model breaches through the REST API connector
• OT platforms such as Nozomi Networks

Then size TAP ports and speeds to match each sensor's interfaces. A sensor with two monitoring ports cannot take four unaggregated feeds.

Choose TAPs Where Evidence Matters

SPAN shares switch resources and drops packets when oversubscribed. Microsoft notes that TAPs pass damaged frames and keep exact packet timing. Use TAPs on any link where an incident might end in an audit or a court. Keep SPAN for low-risk, short-term troubleshooting.

Control What Reaches Each Sensor

Not every sensor needs every packet. Network packet brokers aggregate, filter and load balance traffic before it reaches your tools. Less irrelevant traffic means less sensor load. It can also mean fewer low-value logs flowing into Sentinel.

Match Media and Speed to Each Segment

Most estates mix copper OT links at 1G with fibre cores at 100G or 400G. Separate devices for each add rack space and cabling. Hybrid TAPs combine access and brokering in one chassis for mixed-media sites.

Check Automation and Change Control

Sensors change their traffic needs as threats evolve. Look for a REST API that lets tools adjust filters without manual tickets. Role-based access and TACACS+ support keep those changes auditable.

Model Total Cost of Ownership

Sentinel is already a recurring cost, so watch for a second subscription underneath it. Compare perpetual licences with subscription pricing over three years. Include support, expansion units and engineer time for routine changes. Ask each vendor what happens to features and support if a subscription lapses.

Frequently Asked Questions

Can Microsoft Sentinel Capture Network Packets Directly?

No. Sentinel ingests logs, events and alerts through data connectors, not raw packets. A sensor such as Defender for IoT or Corelight analyses packets from a TAP or SPAN port. It then sends its findings to Sentinel.

Does Microsoft Defender for IoT Support Network TAPs?

Yes. Defender for IoT supports active and passive aggregation TAPs, and Microsoft calls this the best method for forensic monitoring. Its traffic mirroring guidance lists Garland, IXIA and US Robotics models as tested. Microsoft notes that other vendors and models may also be compatible.

What Is the Difference Between a TAP and a SPAN Port for Sentinel?

A TAP copies every packet in hardware, while SPAN mirrors traffic using spare switch capacity. SPAN can drop packets under heavy load without raising an alarm. For a deeper comparison, see our guide to network TAPs vs SPAN.

Can a Packet Broker Reduce Microsoft Sentinel Costs?

It can, indirectly. A packet broker filters traffic before it reaches your sensors. Sensors that see less irrelevant traffic usually generate fewer low-value events. The saving depends on your sensors, connectors and log tiers. Measure current daily ingestion per connector before and after filtering to prove the effect.

How Many Network TAPs Does a Sentinel Deployment Need?

You need one TAP per monitored link that feeds a Sentinel-connected sensor. Start with internet edges, data centre interconnects and links between IT and OT zones. Add East-West links where lateral movement is a concern. A visibility audit maps these points before you buy.

Can TAPs Protect Inline Security Tools That Report to Sentinel?

Yes, if you use a bypass TAP. A bypass tap keeps traffic flowing if an inline appliance fails or restarts. Your IPS or firewall can then report to Sentinel without becoming a single point of failure.

Build Your Sentinel Visibility Layer With Network Critical

Sentinel's detections are only as complete as the traffic your sensors receive. The TAP layer decides that.

Network Critical gives you that layer without a second subscription. Modelled three-year TCO runs 40 to 60 per cent lower than subscription-based incumbents, under perpetual licensing. Hybrid chassis combine access and brokering, and Drag-n-Vu deployments typically complete in under two hours. Output stays tool-agnostic, so your sensor choices stay open.

Network Critical brings 25 years of deployments across finance, energy, telecoms and hospitality. Every product line is visibility. Nothing is bundled to push you towards a wider platform.

Explore Network Critical's network taps to plan your capture points. Then speak to the Network Critical team to request a free network audit of your Sentinel architecture.