Management Pack for Microsoft Advanced Threat Analytics 1.9
This is the Management Pack for Advanced Threat Analytics 1.9. This management pack contains all the classes, views, monitors, and discoveries for the ATA 1.9.
| DisplayName | ID | Base Class | Abstract | Hosted | Singleton | Group | Extension | Accessibility | |
|---|---|---|---|---|---|---|---|---|---|
 | Advanced Threat Analytics 1.9 Center | Microsoft.AdvancedThreatAnalytics.1_9.Center | Microsoft.Windows.ComputerRole | False | True | False | False | False | Public |
 | Advanced Threat Analytics 1.9 Gateway Container | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway | Microsoft.AdvancedThreatAnalytics.ServiceComponent | False | False | False | False | False | Public |
 | Advanced Threat Analytics 1.9 Database | Microsoft.AdvancedThreatAnalytics.1_9.Database | System.Database | False | True | False | False | False | Public |
 | Advanced Threat Analytics 1.9 Gateway | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | Microsoft.Windows.ComputerRole | True | True | False | False | False | Public |
 | Advanced Threat Analytics 1.9 Lightweight Gateway | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.LightWeight | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | False | True | False | False | False | Public |
 | Advanced Threat Analytics 1.9 Standalone Gateway | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.Standalone | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | False | True | False | False | False | Public |
 | Advanced Threat Analytics 1.9 Instances Group | Microsoft.AdvancedThreatAnalytics.1_9.InstancesGroup | Microsoft.SystemCenter.InstanceGroup | False | False | True | True | False | Public |
 | Advanced Threat Analytics 1.9 Seed Class | Microsoft.AdvancedThreatAnalytics.1_9.Seed | Microsoft.Windows.LocalApplication | False | True | False | False | False | Public |
 | Advanced Threat Analytics 1.9 Servers Group | Microsoft.AdvancedThreatAnalytics.1_9.ServersGroup | Microsoft.SystemCenter.ComputerGroup | False | False | True | True | False | Public |
 | Advanced Threat Analytics 1.9 Service | Microsoft.AdvancedThreatAnalytics.1_9.Service | Microsoft.AdvancedThreatAnalytics.ServiceComponent | False | False | False | False | False | Public |
| Advanced Threat Analytics 1.9 Service Group | Microsoft.AdvancedThreatAnalytics.1_9.ServiceGroup | Microsoft.SystemCenter.InstanceGroup | False | False | True | True | False | Public |
| DisplayName | ID | Source | Target | Accessibility | Abstract | |
|---|---|---|---|---|---|---|
 | Microsoft Advanced Threat Analytics 1.9 Center Hosts 1.9 Database | Microsoft.AdvancedThreatAnalytics.1_9.Center.hosts.Microsoft.AdvancedThreatAnalytics.1_9.Database | Microsoft.AdvancedThreatAnalytics.1_9.Center | Microsoft.AdvancedThreatAnalytics.1_9.Database | Public | False |
| Advanced Threat Analytics 1.9 Container (Gateway) Contains 1.9 Gateway Lightweight | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_9.Gateway.LightWeight | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.LightWeight | Public | False |
| Advanced Threat Analytics 1.9 Container (Gateway) Contains 1.9 Gateway Standalone | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_9.Gateway.Standalone | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.Standalone | Public | False |
| Advanced Threat Analytics 1.9 Service Contains 1.9 Center | Microsoft.AdvancedThreatAnalytics.1_9.Service.contains.Microsoft.AdvancedThreatAnalytics.1_9.Center | Microsoft.AdvancedThreatAnalytics.1_9.Service | Microsoft.AdvancedThreatAnalytics.1_9.Center | Public | False |
| Advanced Threat Analytics 1.9 Service Contains 1.9 Container (Gateway) | Microsoft.AdvancedThreatAnalytics.1_9.Service.contains.Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway | Microsoft.AdvancedThreatAnalytics.1_9.Service | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway | Public | False |
| Advanced Threat Analytics Container Contains 1.9 Service | Microsoft.AdvancedThreatAnalytics.Container.contains.Microsoft.AdvancedThreatAnalytics.1_9.Service | Microsoft.AdvancedThreatAnalytics.Container | Microsoft.AdvancedThreatAnalytics.1_9.Service | Public | False |
| DisplayName | ID | Isolation | Accessibility | |
|---|---|---|---|---|
 | Center Discovery Data Source | Microsoft.AdvancedThreatAnalytics.1_9.Center.Discovery.DataSource | Any | Internal |
| Distributed Application Discovery Data Source | Microsoft.AdvancedThreatAnalytics.1_9.DistributedApplication.Discovery.DataSource | Any | Internal |
| Gateway Discovery Data Source | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.Discovery.DataSource | Any | Internal |
| ATA Log File Provider | Microsoft.AdvancedThreatAnalytics.LogFileProvider | Any | Internal |
| ID | Target | |
|---|---|---|
 | Microsoft.AdvancedThreatAnalytics.1_9.Center.ATAConsole.Task.Category | Microsoft.AdvancedThreatAnalytics.1_9.Center.ATAConsole.Task |
| Microsoft.AdvancedThreatAnalytics.1_9.Center.Icon.Category | Microsoft.AdvancedThreatAnalytics.Center.Icon |
| Microsoft.AdvancedThreatAnalytics.1_9.Center.Small.Icon.Category | Microsoft.AdvancedThreatAnalytics.Center.Small.Icon |
| Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway.Icon.Category | Microsoft.AdvancedThreatAnalytics.Container.Gateway.Icon |
| Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway.Small.Icon.Category | Microsoft.AdvancedThreatAnalytics.Container.Gateway.Small.Icon |
| Microsoft.AdvancedThreatAnalytics.1_9.Gateway.Standalone.Icon.Category | Microsoft.AdvancedThreatAnalytics.Gateway.Standalone.Icon |
| Microsoft.AdvancedThreatAnalytics.1_9.Gateway.Standalone.Small.Icon.Category | Microsoft.AdvancedThreatAnalytics.Gateway.Standalone.Small.Icon |
| Microsoft.AdvancedThreatAnalytics.1_9.LightweightGateway.Icon.Category | Microsoft.AdvancedThreatAnalytics.LightweightGateway.Icon |
| Microsoft.AdvancedThreatAnalytics.1_9.LightweightGateway.Small.Icon.Category | Microsoft.AdvancedThreatAnalytics.LightweightGateway.Small.Icon |
| Microsoft.AdvancedThreatAnalytics.1_9.Service.Icon.Category | Microsoft.AdvancedThreatAnalytics.Service.Icon |
| Microsoft.AdvancedThreatAnalytics.1_9.Service.Small.Icon.Category | Microsoft.AdvancedThreatAnalytics.Service.Small.Icon |
| DisplayName | ID | Target | Enabled | |
|---|---|---|---|---|
 | Center Discovery | Microsoft.AdvancedThreatAnalytics.1_9.Center.Discovery | Microsoft.AdvancedThreatAnalytics.1_9.Seed | True |
| Distributed Application Discovery | Microsoft.AdvancedThreatAnalytics.1_9.DistributedApplication.Discovery | Microsoft.SystemCenter.AllManagementServersPool | True |
| Gateway Discovery | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.Discovery | Microsoft.AdvancedThreatAnalytics.1_9.Seed | True |
| Instance Group Discovery | Microsoft.AdvancedThreatAnalytics.1_9.InstancesGroup.Discovery | Microsoft.AdvancedThreatAnalytics.1_9.InstancesGroup | True |
| Seed Discovery | Microsoft.AdvancedThreatAnalytics.1_9.Seed.Discovery | Microsoft.Windows.Server.OperatingSystem | True |
| Servers Group Discovery | Microsoft.AdvancedThreatAnalytics.1_9.ServersGroup.Discovery | Microsoft.AdvancedThreatAnalytics.1_9.ServersGroup | True |
| Service Group Discovery | Microsoft.AdvancedThreatAnalytics.1_9.ServiceGroup.Discovery | Microsoft.AdvancedThreatAnalytics.1_9.ServiceGroup | True |
| DisplayName | ID | Target | Algorithm | Source Monitor | Relationship | Category | Enabled | Alert Generate | Accessibility | |
|---|---|---|---|---|---|---|---|---|---|---|
 | Center Availability Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Center.Availability.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_9.Center | WorstOf | System.Health.AvailabilityState | Microsoft.AdvancedThreatAnalytics.1_9.Center.hosts.Microsoft.AdvancedThreatAnalytics.1_9.Database | AvailabilityHealth | True | False | Public |
| Center Configuration Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Center.Configuration.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_9.Center | WorstOf | System.Health.ConfigurationState | Microsoft.AdvancedThreatAnalytics.1_9.Center.hosts.Microsoft.AdvancedThreatAnalytics.1_9.Database | ConfigurationHealth | True | False | Public |
| Center Performance Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Center.Performance.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_9.Center | WorstOf | System.Health.PerformanceState | Microsoft.AdvancedThreatAnalytics.1_9.Center.hosts.Microsoft.AdvancedThreatAnalytics.1_9.Database | PerformanceHealth | True | False | Public |
| Center Security Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Center.Security.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_9.Center | WorstOf | System.Health.SecurityState | Microsoft.AdvancedThreatAnalytics.1_9.Center.hosts.Microsoft.AdvancedThreatAnalytics.1_9.Database | SecurityHealth | True | False | Public |
| Gateway (Lightweight) Availability Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway.LightWeight.Availability.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway | WorstOf | System.Health.AvailabilityState | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_9.Gateway.LightWeight | AvailabilityHealth | True | False | Public |
| Gateway (Lightweight) Configuration Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway.LightWeight.Configuration.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway | WorstOf | System.Health.ConfigurationState | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_9.Gateway.LightWeight | ConfigurationHealth | True | False | Public |
| Gateway (Lightweight) Performance Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway.LightWeight.Performance.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway | WorstOf | System.Health.PerformanceState | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_9.Gateway.LightWeight | PerformanceHealth | True | False | Public |
| Gateway (Lightweight) Security Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway.LightWeight.Security.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway | WorstOf | System.Health.SecurityState | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_9.Gateway.LightWeight | SecurityHealth | True | False | Public |
| Gateway (Standalone) Availability Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway.Standalone.Availability.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway | WorstOf | System.Health.AvailabilityState | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_9.Gateway.Standalone | AvailabilityHealth | True | False | Public |
| Gateway (Standalone) Configuration Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway.Standalone.Configuration.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway | WorstOf | System.Health.ConfigurationState | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_9.Gateway.Standalone | ConfigurationHealth | True | False | Public |
| Gateway (Standalone) Performance Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway.Standalone.Performance.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway | WorstOf | System.Health.PerformanceState | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_9.Gateway.Standalone | PerformanceHealth | True | False | Public |
| Gateway (Standalone) Security Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway.Standalone.Security.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway | WorstOf | System.Health.SecurityState | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway.contains.Microsoft.AdvancedThreatAnalytics.1_9.Gateway.Standalone | SecurityHealth | True | False | Public |
| Service (Center) Availability Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Service.Center.Availability.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_9.Service | WorstOf | System.Health.AvailabilityState | Microsoft.AdvancedThreatAnalytics.1_9.Service.contains.Microsoft.AdvancedThreatAnalytics.1_9.Center | AvailabilityHealth | True | False | Public |
| Service (Center) Configuration Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Service.Center.Configuration.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_9.Service | WorstOf | System.Health.ConfigurationState | Microsoft.AdvancedThreatAnalytics.1_9.Service.contains.Microsoft.AdvancedThreatAnalytics.1_9.Center | ConfigurationHealth | True | False | Public |
| Service (Center) Performance Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Service.Center.Performance.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_9.Service | WorstOf | System.Health.PerformanceState | Microsoft.AdvancedThreatAnalytics.1_9.Service.contains.Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | False | Public |
| Service (Center) Security Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Service.Center.Security.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_9.Service | WorstOf | System.Health.SecurityState | Microsoft.AdvancedThreatAnalytics.1_9.Service.contains.Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | True | False | Public |
| Service (Gateway) Availability Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Service.Gateway.Availability.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_9.Service | WorstOf | System.Health.AvailabilityState | Microsoft.AdvancedThreatAnalytics.1_9.Service.contains.Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway | AvailabilityHealth | True | False | Public |
| Service (Gateway) Configuration Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Service.Gateway.Configuration.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_9.Service | WorstOf | System.Health.ConfigurationState | Microsoft.AdvancedThreatAnalytics.1_9.Service.contains.Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway | ConfigurationHealth | True | False | Public |
| Service (Gateway) Performance Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Service.Gateway.Performance.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_9.Service | WorstOf | System.Health.PerformanceState | Microsoft.AdvancedThreatAnalytics.1_9.Service.contains.Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway | PerformanceHealth | True | False | Public |
| Service (Gateway) Security Rollup Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Service.Gateway.Security.RollupMonitor | Microsoft.AdvancedThreatAnalytics.1_9.Service | WorstOf | System.Health.SecurityState | Microsoft.AdvancedThreatAnalytics.1_9.Service.contains.Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway | SecurityHealth | True | False | Public |
| Root Availability Rollup Monitor | Microsoft.AdvancedThreatAnalytics.Container.Availability.RollupMonitor | Microsoft.AdvancedThreatAnalytics.Container | WorstOf | System.Health.AvailabilityState | Microsoft.AdvancedThreatAnalytics.Container.contains.Microsoft.AdvancedThreatAnalytics.1_9.Service | AvailabilityHealth | True | False | Public |
| Root Configuration Rollup Monitor | Microsoft.AdvancedThreatAnalytics.Container.Configuration.RollupMonitor | Microsoft.AdvancedThreatAnalytics.Container | WorstOf | System.Health.ConfigurationState | Microsoft.AdvancedThreatAnalytics.Container.contains.Microsoft.AdvancedThreatAnalytics.1_9.Service | ConfigurationHealth | True | False | Public |
| Root Performance Rollup Monitor | Microsoft.AdvancedThreatAnalytics.Container.Performance.RollupMonitor | Microsoft.AdvancedThreatAnalytics.Container | WorstOf | System.Health.PerformanceState | Microsoft.AdvancedThreatAnalytics.Container.contains.Microsoft.AdvancedThreatAnalytics.1_9.Service | PerformanceHealth | True | False | Public |
| Root Security Rollup Monitor | Microsoft.AdvancedThreatAnalytics.Container.Security.RollupMonitor | Microsoft.AdvancedThreatAnalytics.Container | WorstOf | System.Health.SecurityState | Microsoft.AdvancedThreatAnalytics.Container.contains.Microsoft.AdvancedThreatAnalytics.1_9.Service | SecurityHealth | True | False | Public |
| DisplayName | ID | Target | Category | Enabled | Alert Generate | Accessibility | |
|---|---|---|---|---|---|---|---|
 | ATA Center Service Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Center.ATACenter | Microsoft.AdvancedThreatAnalytics.1_9.Center | AvailabilityHealth | True | True | Public |
| Database AtSVC Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseAtSvcBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| Database DNS Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseDnsBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| Database DRSR Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseDrsrBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| Database GroupMembershipChangeEvent Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseGroupMembershipChangeEventBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| Database KerberosAP Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseKerberosApBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| Database KerberosAS Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseKerberosAsBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| Database KerberosTGS Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseKerberosTgsBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| Database LDAP Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseLdapBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| Database LogicalActivity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseLogicalActivityBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| Database LogonEvent Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseLogonEventBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| Database LsaRPC Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseLsaRpcBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| Database Netlogon Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseNetlogonBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| Database NTLM Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseNtlmBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| Database NTLMEvent Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseNtlmEventBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| Database SAMR Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseSamrBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| Database ServiceControl Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseServiceControlBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| Database ServiceInstalledEvent Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseServiceInstalledEventBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| Database SMB Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseSmbBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| Database SrvSVC Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseSrvSvcBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| Database TaskScheduler Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseTaskSchedulerBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| Database VpnAuthenticationEvent Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseVpnAuthenticationEventBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| Database Wmi Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseWmiBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| EntityProfiler Event Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.EntityProfilerEventActivityBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| EntityProfiler Logical Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.EntityProfilerLogicalActivityBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| EntityProfiler Network Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.EntityProfilerNetworkActivityBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| EntityReceiver Entity Batch Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.EntityReceiverEntityBatchBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| EventActivityProcessor Event Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.EventActivityProcessorEventActivityBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| EventActivityProcessor Postponed Event Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.EventActivityProcessorPostponedEventActivityBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| LogicalActivityTranslator Event Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.LogicalActivityTranslatorEventActivityBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| LogicalActivityTranslator Network Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.LogicalActivityTranslatorNetworkActivityBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| LogicalActivityTranslator Unique Entity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.LogicalActivityTranslatorUniqueEntityBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| NetworkActivityProcessor Network Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.NetworkActivityProcessorNetworkActivityBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| NetworkActivityProcessor Postponed Network Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.NetworkActivityProcessorPostponedNetworkActivityBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| UniqueEntityProcessor Unique Entity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.UniqueEntityProcessorUniqueEntityBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True | Public |
| MongoDB Service Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Database.MongoDB | Microsoft.AdvancedThreatAnalytics.1_9.Database | AvailabilityHealth | True | True | Public |
| ATA Gateway Service Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.ATAGateway | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | AvailabilityHealth | True | True | Public |
| ATA Gateway Updater Service Monitor | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.ATAGatewayUpdater | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | AvailabilityHealth | True | True | Public |
| EntityResolver Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.EntityResolverActivityBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceHealth | True | True | Public |
| EntitySender Entity Batch Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.EntitySenderEntityBatchBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceHealth | True | True | Public |
| EntitySender Entity Batch Send Time | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.EntitySenderEntityBatchSendTime.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceHealth | True | True | Public |
| NetworkActivityTranslator Message Data 0 Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.NetworkActivityTranslatorMessageData0BlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceHealth | True | True | Public |
| NetworkListener ETW Dropped Events/Sec | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.NetworkListenerETWDroppedEventsSec.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceHealth | True | True | Public |
| NetworkListener PEF Dropped Events/Sec | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.NetworkListenerPEFDroppedEventsSec.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceHealth | True | True | Public |
| RadiusEventActivityTranslator Radius Packet Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.RadiusEventActivityTranslatorRadiusPacketBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceHealth | True | True | Public |
| SyslogEventActivityTranslator String Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.SyslogEventActivityTranslatorStringBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceHealth | True | True | Public |
| WefEventActivityTranslator String Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.WefEventActivityTranslatorStringBlockSize.PerformanceHealth | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceHealth | True | True | Public |
| DisplayName | ID | Target | Category | Enabled | Alert Generate | |
|---|---|---|---|---|---|---|
 | Abnormal Behavior Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.AbnormalBehaviorSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| Abnormal Protocol Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.AbnormalProtocolSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| Abnormal Sensitive Group Membership Change Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.AbnormalSensitiveGroupMembershipChangeSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| Abnormal Vpn Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.AbnormalVpnSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| Account Enumeration Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.AccountEnumerationSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| Brute Force Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.BruteForceSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| Center Database Data Drive Free Space Monitoring Alert Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.CenterDatabaseDataDriveFreeSpaceMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_9.Center | AvailabilityHealth | True | True |
| Center Database Disconnected Monitoring Alert Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.CenterDatabaseDisconnectedMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_9.Center | AvailabilityHealth | True | True |
| Center External Ip Address Resolution Failure Monitoring Alert Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.CenterExternalIpAddressResolutionFailureMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_9.Center | AvailabilityHealth | True | True |
| Center Mail Monitoring Alert Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.CenterMailMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_9.Center | ConfigurationHealth | True | True |
| Center Not Receiving Traffic Monitoring Alert Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.CenterNotReceivingTrafficMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_9.Center | AvailabilityHealth | True | True |
| Center Overloaded Monitoring Alert Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.CenterOverloadedMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True |
| Center Syslog Monitoring Alert Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.CenterSyslogMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_9.Center | ConfigurationHealth | True | True |
| Certificate Expiry Monitoring Alert Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.CertificateExpiryMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_9.Center | ConfigurationHealth | True | True |
| Database AtSVC Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseAtSvcBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Database DNS Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseDnsBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Database DRSR Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseDrsrBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Database GroupMembershipChangeEvent Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseGroupMembershipChangeEventBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Database KerberosAP Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseKerberosApBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Database KerberosAS Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseKerberosAsBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Database KerberosTGS Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseKerberosTgsBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Database LDAP Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseLdapBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Database LogicalActivity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseLogicalActivityBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Database LogonEvent Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseLogonEventBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Database LsaRPC Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseLsaRpcBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Database Netlogon Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseNetlogonBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Database NTLM Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseNtlmBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Database NTLMEvent Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseNtlmEventBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Database SAMR Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseSAMRBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Database ServiceControl Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseServiceControlBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Database ServiceInstalledEvent Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseServiceInstalledEventBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Database SMB Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseSmbBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Database SrvSVC Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseSrvSvcBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Database TaskScheduler Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseTaskSchedulerBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Database VpnAuthenticationEvent Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseVpnAuthenticationEventBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Database Wmi Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.DatabaseWmiBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Directory Services Replication Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.DirectoryServicesReplicationSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| DNS Reconnaissance Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.DnsReconnaissanceSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| Encryption Downgrade-Golden Ticket Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.EncryptionDowngradeGoldenTicketSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| Encryption Downgrade-Over Pass-the-Hash Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.EncryptionDowngradeOverPasstheHashSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| Encryption Downgrade-Skeleton Key Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.EncryptionDowngradeSkeletonKeySuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| Encryption Downgrade Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.EncryptionDowngradeSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| EntityProfiler Event Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.EntityProfilerEventActivityBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| EntityProfiler Logical Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.EntityProfilerLogicalActivityBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| EntityProfiler Network Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.EntityProfilerNetworkActivityBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| EntityReceiver Entity Batch Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.EntityReceiverEntityBatchBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Enumerate Sessions Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.EnumerateSessionsSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| EventActivityProcessor Event Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.EventActivityProcessorEventActivityBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| EventActivityProcessor Postponed Event Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.EventActivityProcessorPostponedEventActivityBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Forged Pac Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.ForgedPacSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| Gateway Capture Network Adapter Faulted Monitoring Alert Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.GatewayCaptureNetworkAdapterFaultedMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_9.Center | AvailabilityHealth | True | True |
| Gateway Capture Network Adapter Missing Monitoring Alert Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.GatewayCaptureNetworkAdapterMissingMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_9.Center | ConfigurationHealth | True | True |
| Gateway Directory Services Client Account Password Expiry Monitoring Alert Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.GatewayDirectoryServicesClientAccountPasswordExpiryMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_9.Center | ConfigurationHealth | True | True |
| Gateway Directory Services Client Connectivity Monitoring Alert Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.GatewayDirectoryServicesClientConnectivityMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_9.Center | AvailabilityHealth | True | True |
| Gateway Disconnected Monitoring Alert Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.GatewayDisconnectedMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_9.Center | AvailabilityHealth | True | True |
| Gateway Domain Synchronizer Not Assigned Monitoring Alert Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.GatewayDomainSynchronizerNotAssignedMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_9.Center | ConfigurationHealth | True | True |
| Gateway Low Memory Monitoring Alert Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.GatewayLowMemoryMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True |
| Gateway Overloaded Event Activities Monitoring Alert Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.GatewayOverloadedEventActivitiesMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True |
| Gateway Overloaded Network Activities Monitoring Alert Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.GatewayOverloadedNetworkActivitiesMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceHealth | True | True |
| Gateway Radius Event Listener Monitoring Alert Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.GatewayRadiusEventListenerMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_9.Center | AvailabilityHealth | True | True |
| Gateways Outdated Monitoring Alert Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.GatewaysOutdatedMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_9.Center | ConfigurationHealth | True | True |
| Gateway Start Failure Monitoring Alert Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.GatewayStartFailureMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_9.Center | AvailabilityHealth | True | True |
| Gateway Syslog Event Listener Monitoring Alert Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.GatewaySyslogEventListenerMonitoringAlert | Microsoft.AdvancedThreatAnalytics.1_9.Center | AvailabilityHealth | True | True |
| Golden Ticket Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.GoldenTicketSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| Honeytoken Activity Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.HoneytokenActivitySuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| Ldap Brute Force Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.LdapBruteForceSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| LogicalActivityTranslator Event Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.LogicalActivityTranslatorEventActivityBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| LogicalActivityTranslator Network Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.LogicalActivityTranslatorNetworkActivityBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| LogicalActivityTranslator Unique Entity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.LogicalActivityTranslatorUniqueEntityBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Malicious Service Creation Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.MaliciousServiceCreationSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| Massive Object Deletion Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.MassiveObjectDeletionSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| NetworkActivityProcessor Network Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.NetworkActivityProcessorNetworkActivityBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| NetworkActivityProcessor Postponed Network Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.NetworkActivityProcessorPostponedNetworkActivityBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| Pass The Hash Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.PassTheHashSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| Pass The Ticket Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.PassTheTicketSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| Remote Execution Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.RemoteExecutionSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| Retrieve Data Protection Backup Key Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.RetrieveDataProtectionBackupKeySuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| SAMR Reconnaissance Suspicious Activity Rule | Microsoft.AdvancedThreatAnalytics.1_9.Center.SamrReconnaissanceSuspiciousActivity | Microsoft.AdvancedThreatAnalytics.1_9.Center | SecurityHealth | False | True |
| UniqueEntityProcessor Unique Entity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Center.UniqueEntityProcessorUniqueEntityBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Center | PerformanceCollection | True | False |
| ATA Gateway Failed to Authenticate Against the Domain Controller | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.ActiveDirectoryAuthenticationFailure | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | AvailabilityHealth | True | True |
| Counters might be disabled in the registry | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.CountersDisabled | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | AvailabilityHealth | True | True |
| EntityResolver Activity Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.EntityResolverActivityBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceCollection | True | False |
| EntitySender Entity Batch Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.EntitySenderEntityBatchBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceCollection | True | False |
| EntitySender Entity Batch Send Time | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.EntitySenderEntityBatchSendTime | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceCollection | True | False |
| ATA Gateway Failed to Authenticate Against Center | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.FailedToAuthenticateAgainstCenter | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | AvailabilityHealth | True | True |
| ATA Gateway failed to establish connection to the ATA Center | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.FailedToEstablishConnectionToCenter | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | AvailabilityHealth | True | True |
| ATA Gateway Failed to Parse SIEM Syslog Message | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.FailedToParseSyslog | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | AvailabilityHealth | True | True |
| ATA Gateway failed to query the domain controller using the LDAP protocol | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.FailedToQueryDCUsingLDAPProtocol | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | AvailabilityHealth | True | True |
| ATA Gateway failed to synchronize the configuration from the ATA Center | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.FailedToSynchronizeConfigurationFromCenter | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | AvailabilityHealth | True | True |
| ATA Gateway Failed to Validate Center Certificate Chain | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.FailedToValidateCenterCertificateChain | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | AvailabilityHealth | True | True |
| ATA Gateway does not have enough memory | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.GatewayDoesNotHaveEnoughMemory | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | AvailabilityHealth | True | True |
| GatewayUpdaterResourceManager Commit Memory Max Size | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.GatewayUpdaterResourceManagerCommitMemoryMaxSize | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceCollection | True | False |
| GatewayUpdaterResourceManager CPU Time Max \% | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.GatewayUpdaterResourceManagerCPUTimeMax_ | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceCollection | True | False |
| GatewayUpdaterResourceManager Working Set Limit Size | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.GatewayUpdaterResourceManagerWorkingSetLimitSize | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceCollection | True | False |
| There is a host entry in the HOSTS file pointing to the machine's shortname | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.HostEntryInHOSTSFile | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | AvailabilityHealth | True | True |
| Message Analyzer is installed on the ATA Gateway | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.MessageAnalyzerIsInstalledOnGateway | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | AvailabilityHealth | True | True |
| NetworkActivityTranslator Message Data 0 Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.NetworkActivityTranslatorMessageData0BlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceCollection | True | False |
| NetworkListener ETW Dropped Events/Sec | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.NetworkListenerETWDroppedEvents_Sec | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceCollection | True | False |
| NetworkListener PEF Dropped Events/Sec | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.NetworkListenerPEFDroppedEvents_Sec | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceCollection | True | False |
| NetworkListener PEF Parsed Messages/Sec | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.NetworkListenerPEFParsedMessages_Sec | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceCollection | True | False |
| There are other pending installations on your computer | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.OtherPendingInstallations | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | AvailabilityHealth | True | True |
| PEF (Message Analyzer) was not installed correctly | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.PEFWasNotInstalledCorrectly | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | AvailabilityHealth | True | True |
| PIDs was enabled for process names in the ATA Gateway | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.PIDsWasEnabledForProcessNamesInGateway | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | AvailabilityHealth | True | True |
| RadiusEventActivityTranslator Radius Packet Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.RadiusEventActivityTranslatorRadiusPacketBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceCollection | True | False |
| SyslogEventActivityTranslator String Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.SyslogEventActivityTranslatorStringBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceCollection | True | False |
| WefEventActivityTranslator String Block Size | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.WefEventActivityTranslatorStringBlockSize | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | PerformanceCollection | True | False |
| DisplayName | ID | Target | Accessibility | Category | Enabled | |
|---|---|---|---|---|---|---|
 | Restart ATACenter Service | Microsoft.AdvancedThreatAnalytics.1_9.Center.ATACenter.Restart | Microsoft.AdvancedThreatAnalytics.1_9.Center | Internal | Maintenance | True |
| Start ATACenter Service | Microsoft.AdvancedThreatAnalytics.1_9.Center.ATACenter.Start | Microsoft.AdvancedThreatAnalytics.1_9.Center | Internal | Maintenance | True |
| Stop ATACenter Service | Microsoft.AdvancedThreatAnalytics.1_9.Center.ATACenter.Stop | Microsoft.AdvancedThreatAnalytics.1_9.Center | Internal | Maintenance | True |
| Restart MongoDB Service | Microsoft.AdvancedThreatAnalytics.1_9.Database.MongoDB.Restart | Microsoft.AdvancedThreatAnalytics.1_9.Database | Internal | Maintenance | True |
| Start MongoDB Service | Microsoft.AdvancedThreatAnalytics.1_9.Database.MongoDB.Start | Microsoft.AdvancedThreatAnalytics.1_9.Database | Internal | Maintenance | True |
| Stop MongoDB Service | Microsoft.AdvancedThreatAnalytics.1_9.Database.MongoDB.Stop | Microsoft.AdvancedThreatAnalytics.1_9.Database | Internal | Maintenance | True |
| Restart ATAGateway Service | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.ATAGateway.Restart | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | Internal | Maintenance | True |
| Start ATAGateway Service | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.ATAGateway.Start | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | Internal | Maintenance | True |
| Stop ATAGateway Service | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.ATAGateway.Stop | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | Internal | Maintenance | True |
| Restart ATAGatewayUpdater Service | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.ATAGatewayUpdater.Restart | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | Internal | Maintenance | True |
| Start ATAGatewayUpdater Service | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.ATAGatewayUpdater.Start | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | Internal | Maintenance | True |
| Stop ATAGatewayUpdater Service | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.ATAGatewayUpdater.Stop | Microsoft.AdvancedThreatAnalytics.1_9.Gateway | Internal | Maintenance | True |
| DisplayName | ID | Target | Accessibility | Enabled | |
|---|---|---|---|---|---|
 | Open ATA Center Console Task | Microsoft.AdvancedThreatAnalytics.1_9.Center.ATAConsole.Task | Microsoft.AdvancedThreatAnalytics.1_9.Center | Internal | True |
| ID | FolderName | ElementID | |
|---|---|---|---|
 | Microsoft.AdvancedThreatAnalytics.1_9.Center.SecurityAlerts.FolderItem | Microsoft.AdvancedThreatAnalytics.1_9.Folder.Root | Microsoft.AdvancedThreatAnalytics.1_9.Center.SecurityAlerts |
| Microsoft.AdvancedThreatAnalytics.1_9.HealthAlerts.FolderItem | Microsoft.AdvancedThreatAnalytics.1_9.Folder.Root | Microsoft.AdvancedThreatAnalytics.1_9.HealthAlerts |
| Microsoft.AdvancedThreatAnalytics.1_9.PerformanceAlerts.FolderItem | Microsoft.AdvancedThreatAnalytics.1_9.Folder.Root | Microsoft.AdvancedThreatAnalytics.1_9.PerformanceAlerts |
| Microsoft.AdvancedThreatAnalytics.1_9.StateGrid.FolderItem | Microsoft.AdvancedThreatAnalytics.1_9.Folder.Root | Microsoft.AdvancedThreatAnalytics.1_9.StateGrid |
| DisplayName | ID | ParentFolder | Accessibility | |
|---|---|---|---|---|
| Advanced Threat Analytics 1.9 | Microsoft.AdvancedThreatAnalytics.1_9.Folder.Root | Microsoft.AdvancedThreatAnalytics.Folder.Root | Public |
| DisplayName | ID | ImageID | |
|---|---|---|---|
 | Advanced Threat Analytics 1.9 Center | Microsoft.AdvancedThreatAnalytics.1_9.Center | Microsoft.AdvancedThreatAnalytics.Center.Small.Icon |
| Advanced Threat Analytics 1.9 Gateway Container | Microsoft.AdvancedThreatAnalytics.1_9.Container.Gateway | Microsoft.AdvancedThreatAnalytics.Container.Gateway.Small.Icon |
| Advanced Threat Analytics 1.9 Lightweight Gateway | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.LightWeight | Microsoft.AdvancedThreatAnalytics.LightweightGateway.Small.Icon |
| Advanced Threat Analytics 1.9 Standalone Gateway | Microsoft.AdvancedThreatAnalytics.1_9.Gateway.Standalone | Microsoft.AdvancedThreatAnalytics.Gateway.Standalone.Small.Icon |
| Advanced Threat Analytics 1.9 Service | Microsoft.AdvancedThreatAnalytics.1_9.Service | Microsoft.AdvancedThreatAnalytics.Service.Small.Icon |
| DisplayName | ID | Target | Type | Accessibility | Visible | |
|---|---|---|---|---|---|---|
 | Security Alerts | Microsoft.AdvancedThreatAnalytics.1_9.Center.SecurityAlerts | Microsoft.AdvancedThreatAnalytics.1_9.Center | Microsoft.SystemCenter.AlertViewType | Internal | True |
| Health Alerts | Microsoft.AdvancedThreatAnalytics.1_9.HealthAlerts | Microsoft.AdvancedThreatAnalytics.1_9.InstancesGroup | Microsoft.SystemCenter.AlertViewType | Public | True |
| Performance Alerts | Microsoft.AdvancedThreatAnalytics.1_9.PerformanceAlerts | Microsoft.AdvancedThreatAnalytics.1_9.InstancesGroup | Microsoft.SystemCenter.AlertViewType | Public | True |
| ID | Type | Platform | Target | Accessibility | |
|---|---|---|---|---|---|
 | Microsoft.AdvancedThreatAnalytics.1_9.StateGrid.Center.Implementation | Microsoft.AdvancedThreatAnalytics.1_9.StateGrid.Center | Wpf, Silverlight | Public | |
| Microsoft.AdvancedThreatAnalytics.1_9.StateGrid.Details.Implementation | Microsoft.AdvancedThreatAnalytics.1_9.StateGrid.Details | Wpf, Silverlight | Public | |
| Microsoft.AdvancedThreatAnalytics.1_9.StateGrid.Gateway.Implementation | Microsoft.AdvancedThreatAnalytics.1_9.StateGrid.Gateway | Wpf, Silverlight | Public | |
| Microsoft.AdvancedThreatAnalytics.1_9.StateGrid.Implementation | Microsoft.AdvancedThreatAnalytics.1_9.StateGrid | Wpf, Silverlight | Public |
| ID | Type | Parent | Accessibility | |
|---|---|---|---|---|
| Microsoft.AdvancedThreatAnalytics.1_9.StateGrid.Center.Reference | Microsoft.AdvancedThreatAnalytics.1_9.StateGrid.Center | Microsoft.AdvancedThreatAnalytics.1_9.StateGrid | Public |
| Microsoft.AdvancedThreatAnalytics.1_9.StateGrid.Details.Reference | Microsoft.AdvancedThreatAnalytics.1_9.StateGrid.Details | Microsoft.AdvancedThreatAnalytics.1_9.StateGrid | Public |
| Microsoft.AdvancedThreatAnalytics.1_9.StateGrid.Gateway.Reference | Microsoft.AdvancedThreatAnalytics.1_9.StateGrid.Gateway | Microsoft.AdvancedThreatAnalytics.1_9.StateGrid | Public |
| Microsoft.AdvancedThreatAnalytics.1_9.StateGrid.Reference | Microsoft.AdvancedThreatAnalytics.1_9.StateGrid | Microsoft.AdvancedThreatAnalytics.1_9.Folder.Root | Public |
| DisplayName | ID | Accessibility | |
|---|---|---|---|
| Health State | Microsoft.AdvancedThreatAnalytics.1_9.StateGrid | Public |
| Health State - Center | Microsoft.AdvancedThreatAnalytics.1_9.StateGrid.Center | Public |
| Health State - Details | Microsoft.AdvancedThreatAnalytics.1_9.StateGrid.Details | Public |
| Health State - Gateway | Microsoft.AdvancedThreatAnalytics.1_9.StateGrid.Gateway | Public |
Home
ENU 
Show Management Pack References