How does Threat Defender perform in active mode compared to passive mode?

When Threat Defender is used in port mirroring to monitor the network traffic the policy is continuously evaluated for analytics purposes. Therefore, there is no extra performance strain when Threat Defender actively enforces the policy.