MAR Threat Workspace in on-premise envivorments

[Alons]

I was wondering, could the MAR threat workspace and the trace rules work without any connection to the cloud? If so, please explain to me how to do this... If not, is there any alternatives to on-premise organizations?

Thank you

[Daveb3d]

There isn't.    

If you want to come closest,  write Triggers against key threats and monitor any ATP containment event (at least from key parent processes) where daysbeforedetection=0.