Management Pack for Microsoft Advanced Threat Analytics 1.7
This is the Management Pack for Advanced Threat Analytics 1.7. This management pack contains all the classes, views, monitors, and discoveries for the ATA 1.7.
| DisplayName | ID | Base Class | Abstract | Hosted | Singleton | Group | Extension | Accessibility | |
|---|---|---|---|---|---|---|---|---|---|
 | Advanced Threat Analytics 1.7 Center | Microsoft.AdvancedThreatAnalytics.1_7.Center | Microsoft.Windows.ComputerRole | False | True | False | False | False | Public |
 | Advanced Threat Analytics 1.7 Gateway Container | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway | Microsoft.AdvancedThreatAnalytics.ServiceComponent | False | False | False | False | False | Public |
 | Advanced Threat Analytics 1.7 Database | Microsoft.AdvancedThreatAnalytics.1_7.Database | System.Database | False | True | False | False | False | Public |
 | Advanced Threat Analytics 1.7 Gateway | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | Microsoft.Windows.ComputerRole | True | True | False | False | False | Public |
 | Advanced Threat Analytics 1.7 Lightweight Gateway | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.LightWeight | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | False | True | False | False | False | Public |
 | Advanced Threat Analytics 1.7 Standalone Gateway | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.Standalone | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | False | True | False | False | False | Public |
 | Advanced Threat Analytics 1.7 Instances Group | Microsoft.AdvancedThreatAnalytics.1_7.InstancesGroup | Microsoft.SystemCenter.InstanceGroup | False | False | True | True | False | Public |
 | Advanced Threat Analytics 1.7 Seed Class | Microsoft.AdvancedThreatAnalytics.1_7.Seed | Microsoft.Windows.LocalApplication | False | True | False | False | False | Public |
 | Advanced Threat Analytics 1.7 Servers Group | Microsoft.AdvancedThreatAnalytics.1_7.ServersGroup | Microsoft.SystemCenter.ComputerGroup | False | False | True | True | False | Public |
 | Advanced Threat Analytics 1.7 Service | Microsoft.AdvancedThreatAnalytics.1_7.Service | Microsoft.AdvancedThreatAnalytics.ServiceComponent | False | False | False | False | False | Public |
| Advanced Threat Analytics 1.7 Service Group | Microsoft.AdvancedThreatAnalytics.1_7.ServiceGroup | Microsoft.SystemCenter.InstanceGroup | False | False | True | True | False | Public |
| DisplayName | ID | Source | Target | Accessibility | Abstract | |
|---|---|---|---|---|---|---|
 | Microsoft Advanced Threat Analytics 1.7 Center Hosts 1.7 Database | Microsoft.AdvancedThreatAnalytics.1_7.Center.hosts.Microsoft.AdvancedThreatAnalytics.1_7.Database | Microsoft.AdvancedThreatAnalytics.1_7.Center | Microsoft.AdvancedThreatAnalytics.1_7.Database | Public | False |
| Advanced Threat Analytics 1.7 Container (Gateway) Contains 1.7 Gateway Lightweight | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_7.Gateway.LightWeight | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.LightWeight | Public | False |
| Advanced Threat Analytics 1.7 Container (Gateway) Contains 1.7 Gateway Standalone | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_7.Gateway.Standalone | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.Standalone | Public | False |
| Advanced Threat Analytics 1.7 Service Contains 1.7 Center | Microsoft.AdvancedThreatAnalytics.1_7.Service.contains.Microsoft.AdvancedThreatAnalytics.1_7.Center | Microsoft.AdvancedThreatAnalytics.1_7.Service | Microsoft.AdvancedThreatAnalytics.1_7.Center | Public | False |
| Advanced Threat Analytics 1.7 Service Contains 1.7 Container (Gateway) | Microsoft.AdvancedThreatAnalytics.1_7.Service.contains.Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway | Microsoft.AdvancedThreatAnalytics.1_7.Service | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway | Public | False |
| Advanced Threat Analytics Container Contains 1.7 Service | Microsoft.AdvancedThreatAnalytics.Container.contains.Microsoft.AdvancedThreatAnalytics.1_7.Service | Microsoft.AdvancedThreatAnalytics.Container | Microsoft.AdvancedThreatAnalytics.1_7.Service | Public | False |
| DisplayName | ID | Isolation | Accessibility | |
|---|---|---|---|---|
 | Advanced Threat Analytics 1.7 Center Discovery Data Source | Microsoft.AdvancedThreatAnalytics.1_7.Center.Discovery.DataSource | Any | Internal |
| Advanced Threat Analytics 1.7 Distributed Application Discovery Data Source | Microsoft.AdvancedThreatAnalytics.1_7.DistributedApplication.Discovery.DataSource | Any | Internal |
| Advanced Threat Analytics 1.7 Gateway Discovery Data Source | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.Discovery.DataSource | Any | Internal |
| ATA Log File Provider | Microsoft.AdvancedThreatAnalytics.LogFileProvider | Any | Internal |
| ID | Target | |
|---|---|---|
 | Microsoft.AdvancedThreatAnalytics.1_7.Center.ATAConsole.Task.Category | Microsoft.AdvancedThreatAnalytics.1_7.Center.ATAConsole.Task |
| Microsoft.AdvancedThreatAnalytics.1_7.Center.Icon.Category | Microsoft.AdvancedThreatAnalytics.Center.Icon |
| Microsoft.AdvancedThreatAnalytics.1_7.Center.Small.Icon.Category | Microsoft.AdvancedThreatAnalytics.Center.Small.Icon |
| Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.Icon.Category | Microsoft.AdvancedThreatAnalytics.Container.Gateway.Icon |
| Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.Small.Icon.Category | Microsoft.AdvancedThreatAnalytics.Container.Gateway.Small.Icon |
| Microsoft.AdvancedThreatAnalytics.1_7.Gateway.Standalone.Icon.Category | Microsoft.AdvancedThreatAnalytics.Gateway.Standalone.Icon |
| Microsoft.AdvancedThreatAnalytics.1_7.Gateway.Standalone.Small.Icon.Category | Microsoft.AdvancedThreatAnalytics.Gateway.Standalone.Small.Icon |
| Microsoft.AdvancedThreatAnalytics.1_7.LightweightGateway.Icon.Category | Microsoft.AdvancedThreatAnalytics.LightweightGateway.Icon |
| Microsoft.AdvancedThreatAnalytics.1_7.LightweightGateway.Small.Icon.Category | Microsoft.AdvancedThreatAnalytics.LightweightGateway.Small.Icon |
| Microsoft.AdvancedThreatAnalytics.1_7.Service.Icon.Category | Microsoft.AdvancedThreatAnalytics.Service.Icon |
| Microsoft.AdvancedThreatAnalytics.1_7.Service.Small.Icon.Category | Microsoft.AdvancedThreatAnalytics.Service.Small.Icon |
| DisplayName | ID | Target | Enabled | |
|---|---|---|---|---|
 | Advanced Threat Analytics 1.7 Center Discovery | Microsoft.AdvancedThreatAnalytics.1_7.Center.Discovery | Microsoft.AdvancedThreatAnalytics.1_7.Seed | True |
| Advanced Threat Analytics 1.7 Distributed Application Discovery | Microsoft.AdvancedThreatAnalytics.1_7.DistributedApplication.Discovery | Microsoft.SystemCenter.AllManagementServersPool | True |
| Advanced Threat Analytics 1.7 Gateway Discovery | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.Discovery | Microsoft.AdvancedThreatAnalytics.1_7.Seed | True |
| Advanced Threat Analytics 1.7 Instance Group Discovery | Microsoft.AdvancedThreatAnalytics.1_7.InstancesGroup.Discovery | Microsoft.AdvancedThreatAnalytics.1_7.InstancesGroup | True |
| Advanced Threat Analytics 1.7 Seed Discovery | Microsoft.AdvancedThreatAnalytics.1_7.Seed.Discovery | Microsoft.Windows.Server.OperatingSystem | True |
| Advanced Threat Analytics 1.7 Servers Group Discovery | Microsoft.AdvancedThreatAnalytics.1_7.ServersGroup.Discovery | Microsoft.AdvancedThreatAnalytics.1_7.ServersGroup | True |
| Advanced Threat Analytics 1.7 Service Group Discovery | Microsoft.AdvancedThreatAnalytics.1_7.ServiceGroup.Discovery | Microsoft.AdvancedThreatAnalytics.1_7.ServiceGroup | True |
| DisplayName | ID | Target | Algorithm | Source Monitor | Relationship | Category | Enabled | Alert Generate | Accessibility | |
|---|---|---|---|---|---|---|---|---|---|---|
 | Center Availability Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Center.Availability.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_7.Center | WorstOf | System.Health.AvailabilityState | Microsoft.AdvancedThreatAnalytics.1_7.Center.hosts.Microsoft.AdvancedThreatAnalytics.1_7.Database | AvailabilityHealth | True | False | Public |
| Center Configuration Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Center.Configuration.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_7.Center | WorstOf | System.Health.ConfigurationState | Microsoft.AdvancedThreatAnalytics.1_7.Center.hosts.Microsoft.AdvancedThreatAnalytics.1_7.Database | ConfigurationHealth | True | False | Public |
| Center Performance Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Center.Performance.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_7.Center | WorstOf | System.Health.PerformanceState | Microsoft.AdvancedThreatAnalytics.1_7.Center.hosts.Microsoft.AdvancedThreatAnalytics.1_7.Database | PerformanceHealth | True | False | Public |
| Center Security Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Center.Security.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_7.Center | WorstOf | System.Health.SecurityState | Microsoft.AdvancedThreatAnalytics.1_7.Center.hosts.Microsoft.AdvancedThreatAnalytics.1_7.Database | SecurityHealth | True | False | Public |
| Gateway (Lightweight) Availability Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.LightWeight.Availability.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway | WorstOf | System.Health.AvailabilityState | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_7.Gateway.LightWeight | AvailabilityHealth | True | False | Public |
| Gateway (Lightweight) Configuration Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.LightWeight.Configuration.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway | WorstOf | System.Health.ConfigurationState | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_7.Gateway.LightWeight | ConfigurationHealth | True | False | Public |
| Gateway (Lightweight) Performance Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.LightWeight.Performance.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway | WorstOf | System.Health.PerformanceState | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_7.Gateway.LightWeight | PerformanceHealth | True | False | Public |
| Gateway (Lightweight) Security Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.LightWeight.Security.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway | WorstOf | System.Health.SecurityState | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_7.Gateway.LightWeight | SecurityHealth | True | False | Public |
| Gateway (Standalone) Availability Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.Standalone.Availability.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway | WorstOf | System.Health.AvailabilityState | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_7.Gateway.Standalone | AvailabilityHealth | True | False | Public |
| Gateway (Standalone) Configuration Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.Standalone.Configuration.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway | WorstOf | System.Health.ConfigurationState | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_7.Gateway.Standalone | ConfigurationHealth | True | False | Public |
| Gateway (Standalone) Performance Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.Standalone.Performance.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway | WorstOf | System.Health.PerformanceState | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_7.Gateway.Standalone | PerformanceHealth | True | False | Public |
| Gateway (Standalone) Security Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.Standalone.Security.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway | WorstOf | System.Health.SecurityState | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_7.Gateway.Standalone | SecurityHealth | True | False | Public |
| Service (Center) Availability Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Service.Center.Availability.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_7.Service | WorstOf | System.Health.AvailabilityState | Microsoft.AdvancedThreatAnalytics.1_7.Service.contains.Microsoft.AdvancedThreatAnalytics.1_7.Center | AvailabilityHealth | True | False | Public |
| Service (Center) Configuration Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Service.Center.Configuration.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_7.Service | WorstOf | System.Health.ConfigurationState | Microsoft.AdvancedThreatAnalytics.1_7.Service.contains.Microsoft.AdvancedThreatAnalytics.1_7.Center | ConfigurationHealth | True | False | Public |
| Service (Center) Performance Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Service.Center.Performance.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_7.Service | WorstOf | System.Health.PerformanceState | Microsoft.AdvancedThreatAnalytics.1_7.Service.contains.Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | False | Public |
| Service (Center) Security Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Service.Center.Security.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_7.Service | WorstOf | System.Health.SecurityState | Microsoft.AdvancedThreatAnalytics.1_7.Service.contains.Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | True | False | Public |
| Service (Gateway) Availability Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Service.Gateway.Availability.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_7.Service | WorstOf | System.Health.AvailabilityState | Microsoft.AdvancedThreatAnalytics.1_7.Service.contains.Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway | AvailabilityHealth | True | False | Public |
| Service (Gateway) Configuration Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Service.Gateway.Configuration.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_7.Service | WorstOf | System.Health.ConfigurationState | Microsoft.AdvancedThreatAnalytics.1_7.Service.contains.Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway | ConfigurationHealth | True | False | Public |
| Service (Gateway) Performance Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Service.Gateway.Performance.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_7.Service | WorstOf | System.Health.PerformanceState | Microsoft.AdvancedThreatAnalytics.1_7.Service.contains.Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway | PerformanceHealth | True | False | Public |
| Service (Gateway) Security Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Service.Gateway.Security.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_7.Service | WorstOf | System.Health.SecurityState | Microsoft.AdvancedThreatAnalytics.1_7.Service.contains.Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway | SecurityHealth | True | False | Public |
| Root Availability Rollup Monitor | Microsoft.AdvancedThreatAnalytics.Container.Availability.RollupMonitor | Microsoft.AdvancedThreatAnalytics.Container | WorstOf | System.Health.AvailabilityState | Microsoft.AdvancedThreatAnalytics.Container.contains.Microsoft.AdvancedThreatAnalytics.1_7.Service | AvailabilityHealth | True | False | Public |
| Root Configuration Rollup Monitor | Microsoft.AdvancedThreatAnalytics.Container.Configuration.RollupMonitor | Microsoft.AdvancedThreatAnalytics.Container | WorstOf | System.Health.ConfigurationState | Microsoft.AdvancedThreatAnalytics.Container.contains.Microsoft.AdvancedThreatAnalytics.1_7.Service | ConfigurationHealth | True | False | Public |
| Root Performance Rollup Monitor | Microsoft.AdvancedThreatAnalytics.Container.Performance.RollupMonitor | Microsoft.AdvancedThreatAnalytics.Container | WorstOf | System.Health.PerformanceState | Microsoft.AdvancedThreatAnalytics.Container.contains.Microsoft.AdvancedThreatAnalytics.1_7.Service | PerformanceHealth | True | False | Public |
| Root Security Rollup Monitor | Microsoft.AdvancedThreatAnalytics.Container.Security.RollupMonitor | Microsoft.AdvancedThreatAnalytics.Container | WorstOf | System.Health.SecurityState | Microsoft.AdvancedThreatAnalytics.Container.contains.Microsoft.AdvancedThreatAnalytics.1_7.Service | SecurityHealth | True | False | Public |
| DisplayName | ID | Target | Category | Enabled | Alert Generate | Accessibility | |
|---|---|---|---|---|---|---|---|
 | ATA Center Service Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Center.ATACenter | Microsoft.AdvancedThreatAnalytics.1_7.Center | AvailabilityHealth | True | True | Public |
| Database AtSVC Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseAtSvcBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True | Public |
| Database DirectoryServicesActivity Block Size< | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseDirectoryServicesActivityBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True | Public |
| Database DNS Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseDnsBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True | Public |
| Database DRSR Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseDrsrBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True | Public |
| Database KerberosAP Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseKerberosApBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True | Public |
| Database KerberosAS Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseKerberosAsBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True | Public |
| Database KerberosTGS Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseKerberosTgsBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True | Public |
| Database LDAP Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseLdapBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True | Public |
| Database LsaRPC Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseLsaRpcBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True | Public |
| Database Netlogon Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseNetlogonBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True | Public |
| Database NTLM Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseNtlmBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True | Public |
| Database NTLMEvent Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseNtlmEventBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True | Public |
| Database SAMR Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseSamrBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True | Public |
| Database ServiceControl Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseServiceControlBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True | Public |
| Database SMB Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseSmbBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True | Public |
| Database SrvSVC Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseSrvSvcBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True | Public |
| Database TaskScheduler Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseTaskSchedulerBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True | Public |
| EntityProfiler Network Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.EntityProfilerNetworkActivityBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True | Public |
| EntityReceiver Entity Batch Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.EntityReceiverEntityBatchBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True | Public |
| NetworkActivityProcessor Network Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.NetworkActivityProcessorNetworkActivityBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True | Public |
| MongoDB Service Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Database.MongoDB | Microsoft.AdvancedThreatAnalytics.1_7.Database | AvailabilityHealth | True | True | Public |
| ATA Gateway Service Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.ATAGateway | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | AvailabilityHealth | True | True | Public |
| ATA Gateway Updater Service Monitor | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.ATAGatewayUpdater | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | AvailabilityHealth | True | True | Public |
| EntityResolver Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.EntityResolverActivityBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | PerformanceHealth | True | True | Public |
| EntitySender Entity Batch Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.EntitySenderEntityBatchBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | PerformanceHealth | True | True | Public |
| EntitySender Entity Batch Send Time | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.EntitySenderEntityBatchSendTime.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | PerformanceHealth | True | True | Public |
| NetworkActivityTranslator Message Data 0 Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkActivityTranslatorMessageData0BlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | PerformanceHealth | True | True | Public |
| NetworkActivityTranslator Message Data 1 Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkActivityTranslatorMessageData1BlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | PerformanceHealth | True | True | Public |
| NetworkActivityTranslator Message Data 2 Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkActivityTranslatorMessageData2BlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | PerformanceHealth | True | True | Public |
| NetworkListener ETW Dropped Events/Sec | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkListenerETWDroppedEventsSec.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | PerformanceHealth | True | True | Public |
| NetworkListener PEF Dropped Events/Sec | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkListenerPEFDroppedEventsSec.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | PerformanceHealth | True | True | Public |
| DisplayName | ID | Target | Category | Enabled | Alert Generate | |
|---|---|---|---|---|---|---|
 | Abnormal Behavior Suspicious Activity Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.AbnormalBehaviorSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | False | True |
| Abnormal SMB Suspicious Activity Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.AbnormalSmbSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | False | True |
| Account Enumeration Suspicious Activity Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.AccountEnumerationSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | False | True |
| Brute Force Suspicious Activity Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.BruteForceSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | False | True |
| ATA 1.7 - Center Database Data Drive Free Space Monitoring Alert Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.CenterDatabaseDataDriveFreeSpaceMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_7.Center | AvailabilityHealth | True | True |
| ATA 1.7 - Center Overloaded Monitoring Alert Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.CenterOverloadedMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True |
| ATA 1.7 - Certificate Expiry Monitoring Alert Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.CertificateExpiryMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_7.Center | ConfigurationHealth | True | True |
| Computer Pre-Authentication Failed Suspicious Activity Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.ComputerPreauthenticationFailedSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | False | True |
| Database AtSVC Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseAtSvcBlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceCollection | True | False |
| Database DirectoryServicesActivity Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseDirectoryServicesActivityBlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceCollection | True | False |
| ATA 1.7 - Database Disconnected Monitoring Alert Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseDisconnectedMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_7.Center | AvailabilityHealth | True | True |
| Database DNS Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseDnsBlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceCollection | True | False |
| Database DRSR Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseDrsrBlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceCollection | True | False |
| Database KerberosAP Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseKerberosApBlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceCollection | True | False |
| Database KerberosAS Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseKerberosAsBlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceCollection | True | False |
| Database KerberosTGS Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseKerberosTgsBlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceCollection | True | False |
| Database LDAP Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseLdapBlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceCollection | True | False |
| Database LsaRPC Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseLsaRpcBlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceCollection | True | False |
| Database Netlogon Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseNetlogonBlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceCollection | True | False |
| Database NTLM Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseNtlmBlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceCollection | True | False |
| Database NTLMEvent Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseNtlmEventBlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceCollection | True | False |
| Database ServiceControl Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseServiceControlBlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceCollection | True | False |
| Database SMB Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseSmbBlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceCollection | True | False |
| Database SrvSVC Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseSrvSvcBlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceCollection | True | False |
| Database TaskScheduler Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseTaskSchedulerBlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceCollection | True | False |
| ATA 1.7 - Directory Services Client Account Password Expiry Monitoring Alert Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.DirectoryServicesClientAccountPasswordExpiryMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_7.Center | ConfigurationHealth | True | True |
| Directory Services Replication Suspicious Activity Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.DirectoryServicesReplicationSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | False | True |
| DNS Reconnaissance Suspicious Activity Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.DnsReconnaissanceSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | False | True |
| ATA 1.7 - Domain Synchronizer Not Assigned Monitoring Alert Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.DomainSynchronizerNotAssignedMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_7.Center | ConfigurationHealth | True | True |
| Encryption Downgrade Suspicious Activity Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.EncryptionDowngradeSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | False | True |
| Encryption Downgrade Suspicious Activity (Golden Ticket) Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.EncryptionDowngradeSuspiciousActivity_GoldenTicket | Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | False | True |
| Encryption Downgrade Suspicious Activity (Overpass the Hash) Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.EncryptionDowngradeSuspiciousActivity_OverpasstheHash | Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | False | True |
| Encryption Downgrade Suspicious Activity (Skeleton Key) Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.EncryptionDowngradeSuspiciousActivity_SkeletonKey | Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | False | True |
| EntityProfiler Network Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.EntityProfilerNetworkActivityBlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceCollection | True | False |
| EntityReceiver Entity Batch Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.EntityReceiverEntityBatchBlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceCollection | True | False |
| Enumerate Sessions Suspicious Activity Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.EnumerateSessionsSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | False | True |
| Forged Pac Suspicious Activity Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.ForgedPacSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | False | True |
| ATA 1.7 - Gateway Capture Network Adapter Faulted Monitoring Alert Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayCaptureNetworkAdapterFaultedMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_7.Center | AvailabilityHealth | True | True |
| ATA 1.7 - Gateway Capture Network Adapter Missing Monitoring Alert Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayCaptureNetworkAdapterMissingMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_7.Center | ConfigurationHealth | True | True |
| ATA 1.7 - Gateway Directory Services Client Connectivity Monitoring Alert Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayDirectoryServicesClientConnectivityMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_7.Center | AvailabilityHealth | True | True |
| ATA 1.7 - Gateway Disconnected Monitoring Alert Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayDisconnectedMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_7.Center | AvailabilityHealth | True | True |
| ATA 1.7 - Gateway Low Memory Monitoring Alert Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayLowMemoryMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True |
| ATA 1.7 - Gateway Not Receiving Traffic Monitoring Alert Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayNotReceivingTrafficMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_7.Center | AvailabilityHealth | True | True |
| ATA 1.7 - Gateway Overloaded Event Activities Monitoring Alert Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayOverloadedEventActivitiesMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True |
| ATA 1.7 - Gateway Overloaded Network Activities Monitoring Alert Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayOverloadedNetworkActivitiesMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceHealth | True | True |
| ATA 1.7 - Gateways Outdated Monitoring Alert Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewaysOutdatedMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_7.Center | ConfigurationHealth | True | True |
| ATA 1.7 - Gateway Start Failure Monitoring Alert Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayStartFailureMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_7.Center | AvailabilityHealth | True | True |
| Honeytoken Activity Suspicious Activity Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.HoneytokenActivitySuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | False | True |
| LDAP Simple Bind Cleartext Password Suspicious Activity Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.LdapSimpleBindCleartextPasswordSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | False | True |
| ATA 1.7 - Mail Monitoring Alert Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.MailMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_7.Center | ConfigurationHealth | True | True |
| Massive Object Deletion Suspicious Activity Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.MassiveObjectDeletionSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | False | True |
| NetworkActivityProcessor Network Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Center.NetworkActivityProcessorNetworkActivityBlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Center | PerformanceCollection | True | False |
| Pass The Hash Suspicious Activity Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.PassTheHashSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | False | True |
| Pass The Ticket Suspicious Activity Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.PassTheTicketSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | False | True |
| Remote Execution Suspicious Activity Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.RemoteExecutionSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | False | True |
| Retrieve Data Protection Backup Key Suspicious Activity Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.RetrieveDataProtectionBackupKeySuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | False | True |
| SAMR Reconnaissance Suspicious Activity Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.SamrReconnaissanceSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_7.Center | SecurityHealth | False | True |
| ATA 1.7 - Syslog Monitoring Alert Alert Rule | Microsoft.AdvancedThreatAnalytics.1_7.Center.SyslogMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_7.Center | ConfigurationHealth | True | True |
| ATA Gateway Failed to Authenticate Against the Domain Controller | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.ActiveDirectoryAuthenticationFailure | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | AvailabilityHealth | True | True |
| Counters might be disabled in the registry | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.CountersDisabled | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | AvailabilityHealth | True | True |
| EntityResolver Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.EntityResolverActivityBlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | PerformanceCollection | True | False |
| EntitySender Entity Batch Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.EntitySenderEntityBatchBlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | PerformanceCollection | True | False |
| EntitySender Entity Batch Send Time | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.EntitySenderEntityBatchSendTime | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | PerformanceCollection | True | False |
| ATA Gateway Failed to Authenticate Against Center | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToAuthenticateAgainstCenter | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | AvailabilityHealth | True | True |
| ATA Gateway failed to establish connection to the ATA Center | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToEstablishConnectionToCenter | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | AvailabilityHealth | True | True |
| ATA Gateway Failed to Parse SIEM Syslog Message | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToParseSyslog | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | AvailabilityHealth | True | True |
| ATA Gateway failed to query the domain controller using the LDAP protocol | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToQueryDCUsingLDAPProtocol | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | AvailabilityHealth | True | True |
| ATA Gateway failed to synchronize the configuration from the ATA Center | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToSynchronizeConfigurationFromCenter | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | AvailabilityHealth | True | True |
| ATA Gateway Failed to Validate Center Certificate Chain | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToValidateCenterCertificateChain | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | AvailabilityHealth | True | True |
| ATA Gateway does not have enough memory | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.GatewayDoesNotHaveEnoughMemory | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | AvailabilityHealth | True | True |
| GatewayUpdaterResourceManager Commit Memory Max Size | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.GatewayUpdaterResourceManagerCommitMemoryMaxSize | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | PerformanceCollection | True | False |
| GatewayUpdaterResourceManager CPU Time Max \% | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.GatewayUpdaterResourceManagerCPUTimeMax_ | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | PerformanceCollection | True | False |
| GatewayUpdaterResourceManager Working Set Limit Size | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.GatewayUpdaterResourceManagerWorkingSetLimitSize | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | PerformanceCollection | True | False |
| There is a host entry in the HOSTS file pointing to the machine's shortname | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.HostEntryInHOSTSFile | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | AvailabilityHealth | True | True |
| Message Analyzer is installed on the ATA Gateway | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.MessageAnalyzerIsInstalledOnGateway | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | AvailabilityHealth | True | True |
| NetworkActivityTranslator Message Data 0 Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkActivityTranslatorMessageData0BlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | PerformanceCollection | True | False |
| NetworkActivityTranslator Message Data 1 Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkActivityTranslatorMessageData1BlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | PerformanceCollection | True | False |
| NetworkActivityTranslator Message Data 2 Block Size | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkActivityTranslatorMessageData2BlockSize | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | PerformanceCollection | True | False |
| NetworkListener ETW Dropped Events/Sec | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkListenerETWDroppedEvents_Sec | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | PerformanceCollection | True | False |
| NetworkListener PEF Dropped Events/Sec | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkListenerPEFDroppedEvents_Sec | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | PerformanceCollection | True | False |
| NetworkListener PEF Parsed Messages/Sec | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkListenerPEFParsedMessages_Sec | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | PerformanceCollection | True | False |
| There are other pending installations on your computer | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.OtherPendingInstallations | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | AvailabilityHealth | True | True |
| PEF (Message Analyzer) was not installed correctly | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.PEFWasNotInstalledCorrectly | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | AvailabilityHealth | True | True |
| PIDs was enabled for process names in the ATA Gateway | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.PIDsWasEnabledForProcessNamesInGateway | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | AvailabilityHealth | True | True |
| DisplayName | ID | Target | Accessibility | Category | Enabled | |
|---|---|---|---|---|---|---|
 | Restart ATACenter Service | Microsoft.AdvancedThreatAnalytics.1_7.Center.ATACenter.Restart | Microsoft.AdvancedThreatAnalytics.1_7.Center | Internal | Maintenance | True |
| Start ATACenter Service | Microsoft.AdvancedThreatAnalytics.1_7.Center.ATACenter.Start | Microsoft.AdvancedThreatAnalytics.1_7.Center | Internal | Maintenance | True |
| Stop ATACenter Service | Microsoft.AdvancedThreatAnalytics.1_7.Center.ATACenter.Stop | Microsoft.AdvancedThreatAnalytics.1_7.Center | Internal | Maintenance | True |
| Restart MongoDB Service | Microsoft.AdvancedThreatAnalytics.1_7.Database.MongoDB.Restart | Microsoft.AdvancedThreatAnalytics.1_7.Database | Internal | Maintenance | True |
| Start MongoDB Service | Microsoft.AdvancedThreatAnalytics.1_7.Database.MongoDB.Start | Microsoft.AdvancedThreatAnalytics.1_7.Database | Internal | Maintenance | True |
| Stop MongoDB Service | Microsoft.AdvancedThreatAnalytics.1_7.Database.MongoDB.Stop | Microsoft.AdvancedThreatAnalytics.1_7.Database | Internal | Maintenance | True |
| Restart ATAGateway Service | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.ATAGateway.Restart | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | Internal | Maintenance | True |
| Start ATAGateway Service | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.ATAGateway.Start | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | Internal | Maintenance | True |
| Stop ATAGateway Service | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.ATAGateway.Stop | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | Internal | Maintenance | True |
| Restart ATAGatewayUpdater Service | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.ATAGatewayUpdater.Restart | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | Internal | Maintenance | True |
| Start ATAGatewayUpdater Service | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.ATAGatewayUpdater.Start | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | Internal | Maintenance | True |
| Stop ATAGatewayUpdater Service | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.ATAGatewayUpdater.Stop | Microsoft.AdvancedThreatAnalytics.1_7.Gateway | Internal | Maintenance | True |
| DisplayName | ID | Target | Accessibility | Enabled | |
|---|---|---|---|---|---|
 | Open ATA Center Console Task | Microsoft.AdvancedThreatAnalytics.1_7.Center.ATAConsole.Task | Microsoft.AdvancedThreatAnalytics.1_7.Center | Internal | True |
| ID | FolderName | ElementID | |
|---|---|---|---|
 | Microsoft.AdvancedThreatAnalytics.1_7.Center.SecurityAlerts.FolderItem | Microsoft.AdvancedThreatAnalytics.1_7.Folder.Root | Microsoft.AdvancedThreatAnalytics.1_7.Center.SecurityAlerts |
| Microsoft.AdvancedThreatAnalytics.1_7.HealthAlerts.FolderItem | Microsoft.AdvancedThreatAnalytics.1_7.Folder.Root | Microsoft.AdvancedThreatAnalytics.1_7.HealthAlerts |
| Microsoft.AdvancedThreatAnalytics.1_7.PerformanceAlerts.FolderItem | Microsoft.AdvancedThreatAnalytics.1_7.Folder.Root | Microsoft.AdvancedThreatAnalytics.1_7.PerformanceAlerts |
| Microsoft.AdvancedThreatAnalytics.1_7.StateGrid.FolderItem | Microsoft.AdvancedThreatAnalytics.1_7.Folder.Root | Microsoft.AdvancedThreatAnalytics.1_7.StateGrid |
| DisplayName | ID | ParentFolder | Accessibility | |
|---|---|---|---|---|
| Advanced Threat Analytics 1.7 | Microsoft.AdvancedThreatAnalytics.1_7.Folder.Root | Microsoft.AdvancedThreatAnalytics.Folder.Root | Public |
| DisplayName | ID | ImageID | |
|---|---|---|---|
 | Advanced Threat Analytics 1.7 Center | Microsoft.AdvancedThreatAnalytics.1_7.Center | Microsoft.AdvancedThreatAnalytics.Center.Small.Icon |
| Advanced Threat Analytics 1.7 Gateway Container | Microsoft.AdvancedThreatAnalytics.1_7.Container.Gateway | Microsoft.AdvancedThreatAnalytics.Container.Gateway.Small.Icon |
| Advanced Threat Analytics 1.7 Lightweight Gateway | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.LightWeight | Microsoft.AdvancedThreatAnalytics.LightweightGateway.Small.Icon |
| Advanced Threat Analytics 1.7 Standalone Gateway | Microsoft.AdvancedThreatAnalytics.1_7.Gateway.Standalone | Microsoft.AdvancedThreatAnalytics.Gateway.Standalone.Small.Icon |
| Advanced Threat Analytics 1.7 Service | Microsoft.AdvancedThreatAnalytics.1_7.Service | Microsoft.AdvancedThreatAnalytics.Service.Small.Icon |
| DisplayName | ID | Target | Type | Accessibility | Visible | |
|---|---|---|---|---|---|---|
 | Security Alerts | Microsoft.AdvancedThreatAnalytics.1_7.Center.SecurityAlerts | Microsoft.AdvancedThreatAnalytics.1_7.Center | Microsoft.SystemCenter.AlertViewType | Internal | True |
| Health Alerts | Microsoft.AdvancedThreatAnalytics.1_7.HealthAlerts | Microsoft.AdvancedThreatAnalytics.1_7.InstancesGroup | Microsoft.SystemCenter.AlertViewType | Public | True |
| Performance Alerts | Microsoft.AdvancedThreatAnalytics.1_7.PerformanceAlerts | Microsoft.AdvancedThreatAnalytics.1_7.InstancesGroup | Microsoft.SystemCenter.AlertViewType | Public | True |
| ID | Type | Platform | Target | Accessibility | |
|---|---|---|---|---|---|
 | Microsoft.AdvancedThreatAnalytics.1_7.StateGrid.Center.Implementation | Microsoft.AdvancedThreatAnalytics.1_7.StateGrid.Center | Wpf, Silverlight | Public | |
| Microsoft.AdvancedThreatAnalytics.1_7.StateGrid.Details.Implementation | Microsoft.AdvancedThreatAnalytics.1_7.StateGrid.Details | Wpf, Silverlight | Public | |
| Microsoft.AdvancedThreatAnalytics.1_7.StateGrid.Gateway.Implementation | Microsoft.AdvancedThreatAnalytics.1_7.StateGrid.Gateway | Wpf, Silverlight | Public | |
| Microsoft.AdvancedThreatAnalytics.1_7.StateGrid.Implementation | Microsoft.AdvancedThreatAnalytics.1_7.StateGrid | Wpf, Silverlight | Public |
| ID | Type | Parent | Accessibility | |
|---|---|---|---|---|
| Microsoft.AdvancedThreatAnalytics.1_7.StateGrid.Center.Reference | Microsoft.AdvancedThreatAnalytics.1_7.StateGrid.Center | Microsoft.AdvancedThreatAnalytics.1_7.StateGrid | Public |
| Microsoft.AdvancedThreatAnalytics.1_7.StateGrid.Details.Reference | Microsoft.AdvancedThreatAnalytics.1_7.StateGrid.Details | Microsoft.AdvancedThreatAnalytics.1_7.StateGrid | Public |
| Microsoft.AdvancedThreatAnalytics.1_7.StateGrid.Gateway.Reference | Microsoft.AdvancedThreatAnalytics.1_7.StateGrid.Gateway | Microsoft.AdvancedThreatAnalytics.1_7.StateGrid | Public |
| Microsoft.AdvancedThreatAnalytics.1_7.StateGrid.Reference | Microsoft.AdvancedThreatAnalytics.1_7.StateGrid | Microsoft.AdvancedThreatAnalytics.1_7.Folder.Root | Public |
| DisplayName | ID | Accessibility | |
|---|---|---|---|
| Health State | Microsoft.AdvancedThreatAnalytics.1_7.StateGrid | Public |
| Health State - Center | Microsoft.AdvancedThreatAnalytics.1_7.StateGrid.Center | Public |
| Health State - Details | Microsoft.AdvancedThreatAnalytics.1_7.StateGrid.Details | Public |
| Health State - Gateway | Microsoft.AdvancedThreatAnalytics.1_7.StateGrid.Gateway | Public |
Home
ENU 
Show Management Pack References