All Rules in Microsoft.AdvancedThreatAnalytics.1_7 Management Pack

	DisplayName	Description	ID	Target	Category	Enabled	Instance Name	Counter Name	Frequency	Event_ID	Event Source	Alert Generate	Alert Severity	Alert Priority	Remotable	Event Log
	异常行为可疑活动		Microsoft.AdvancedThreatAnalytics.1_7.Center.AbnormalBehaviorSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	异常 SMB 可疑活动		Microsoft.AdvancedThreatAnalytics.1_7.Center.AbnormalSmbSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	帐户枚举可疑活动		Microsoft.AdvancedThreatAnalytics.1_7.Center.AccountEnumerationSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	暴力破解可疑活动		Microsoft.AdvancedThreatAnalytics.1_7.Center.BruteForceSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	中心数据库数据驱动器可用空间监视警报		Microsoft.AdvancedThreatAnalytics.1_7.Center.CenterDatabaseDataDriveFreeSpaceMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	中心重载监视警报		Microsoft.AdvancedThreatAnalytics.1_7.Center.CenterOverloadedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	证书到期监视警报		Microsoft.AdvancedThreatAnalytics.1_7.Center.CertificateExpiryMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	计算机预身份验证失败可疑活动		Microsoft.AdvancedThreatAnalytics.1_7.Center.ComputerPreauthenticationFailedSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	数据库 AtSVC 块大小	排队等待写入数据库的特定类型的网络活动数量	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseAtSvcBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database AtSVC Block Size	300	0		False			True
	数据库 DirectoryServicesActivity 块大小	排队等待写入数据库的特定类型的网络活动数量	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseDirectoryServicesActivityBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database DirectoryServicesActivity Block Size	300	0		False			True
	数据库断开监视警报		Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseDisconnectedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	数据库 DNS 块大小	排队等待写入数据库的特定类型的网络活动数量	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseDnsBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database DNS Block Size	300	0		False			True
	数据库 DRSR 块大小	排队等待写入数据库的特定类型的网络活动数量	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseDrsrBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database DRSR Block Size	300	0		False			True
	数据库 KerberosAP 块大小	排队等待写入数据库的特定类型的网络活动数量	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseKerberosApBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database KerberosAP Block Size	300	0		False			True
	数据库 KerberosAP 块大小	排队等待写入数据库的特定类型的网络活动数量	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseKerberosAsBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database KerberosAS Block Size	300	0		False			True
	数据库 KerberosTGS 块大小	排队等待写入数据库的特定类型的网络活动数量	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseKerberosTgsBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database KerberosTGS Block Size	300	0		False			True
	数据库 LDAP 块大小	排队等待写入数据库的特定类型的网络活动数量	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseLdapBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database LDAP Block Size	300	0		False			True
	数据库 LsaRPC 块大小	排队等待写入数据库的特定类型的网络活动数量	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseLsaRpcBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database LsaRPC Block Size	300	0		False			True
	数据库 Netlogon 块大小	排队等待写入数据库的特定类型的网络活动数量	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseNetlogonBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database Netlogon Block Size	300	0		False			True
	数据库 NTLM 块大小	排队等待写入数据库的特定类型的网络活动数量	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseNtlmBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database NTLM Block Size	300	0		False			True
	数据库 NTLMEvent 块大小	排队等待写入数据库的特定类型的网络活动数量	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseNtlmEventBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database NTLMEvent Block Size	300	0		False			True
	数据库 ServiceControl 块大小	排队等待写入数据库的特定类型的网络活动数量	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseServiceControlBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database ServiceControl Block Size	300	0		False			True
	数据库 SMB 块大小	排队等待写入数据库的特定类型的网络活动数量	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseSmbBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database SMB Block Size	300	0		False			True
	数据库 SrvSVC 块大小	排队等待写入数据库的特定类型的网络活动数量	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseSrvSvcBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database SrvSVC Block Size	300	0		False			True
	数据库 TaskScheduler 块大小	排队等待写入数据库的特定类型的网络活动数量	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseTaskSchedulerBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database TaskScheduler Block Size	300	0		False			True
	目录服务客户端帐户密码过期监视警报		Microsoft.AdvancedThreatAnalytics.1_7.Center.DirectoryServicesClientAccountPasswordExpiryMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	目录服务复制可疑活动		Microsoft.AdvancedThreatAnalytics.1_7.Center.DirectoryServicesReplicationSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	DNS 侦测可疑活动		Microsoft.AdvancedThreatAnalytics.1_7.Center.DnsReconnaissanceSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	域同步器未分配监视警报		Microsoft.AdvancedThreatAnalytics.1_7.Center.DomainSynchronizerNotAssignedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	加密降级可疑活动		Microsoft.AdvancedThreatAnalytics.1_7.Center.EncryptionDowngradeSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	加密降级可疑活动(黄金票证)		Microsoft.AdvancedThreatAnalytics.1_7.Center.EncryptionDowngradeSuspiciousActivity_GoldenTicket	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	加密降级可疑活动(超哈希传递攻击)		Microsoft.AdvancedThreatAnalytics.1_7.Center.EncryptionDowngradeSuspiciousActivity_OverpasstheHash	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	加密降级可疑活动(万能钥匙)		Microsoft.AdvancedThreatAnalytics.1_7.Center.EncryptionDowngradeSuspiciousActivity_SkeletonKey	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	EntityProfiler 网络活动块大小	排队等待分析的网络活动(NA)数量	Microsoft.AdvancedThreatAnalytics.1_7.Center.EntityProfilerNetworkActivityBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	EntityProfiler Network Activity Block Size	300	0		False			True
	EntityReceiver 实体批块大小	由 ATA 中心排队的实体批数	Microsoft.AdvancedThreatAnalytics.1_7.Center.EntityReceiverEntityBatchBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	EntityReceiver Entity Batch Block Size	300	0		False			True
	枚举会话可疑活动		Microsoft.AdvancedThreatAnalytics.1_7.Center.EnumerateSessionsSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	伪造 PAC 可疑活动		Microsoft.AdvancedThreatAnalytics.1_7.Center.ForgedPacSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	网关捕捉网络适配器出错监视警报		Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayCaptureNetworkAdapterFaultedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	网关捕捉网络适配器缺少监视警报		Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayCaptureNetworkAdapterMissingMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	网关目录服务客户端连接性监视警报		Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayDirectoryServicesClientConnectivityMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	网关断开监视警报		Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayDisconnectedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	网关内存不足监视警报		Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayLowMemoryMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	网关未收到流量监视警报		Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayNotReceivingTrafficMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	网关重载事件活动监视警报		Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayOverloadedEventActivitiesMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	网关重载网络活动监视警报		Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayOverloadedNetworkActivitiesMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	网关过时监视警报		Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewaysOutdatedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	网关启动失败监视警报		Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayStartFailureMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	蜜标活动可疑活动		Microsoft.AdvancedThreatAnalytics.1_7.Center.HoneytokenActivitySuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	LDAP 简单绑定明文密码可疑活动		Microsoft.AdvancedThreatAnalytics.1_7.Center.LdapSimpleBindCleartextPasswordSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	邮件监视警报		Microsoft.AdvancedThreatAnalytics.1_7.Center.MailMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	大规模对象删除可疑活动		Microsoft.AdvancedThreatAnalytics.1_7.Center.MassiveObjectDeletionSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	NetworkActivityProcessor 网络活动块大小	排队等待处理的网络活动(NA)数量	Microsoft.AdvancedThreatAnalytics.1_7.Center.NetworkActivityProcessorNetworkActivityBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	NetworkActivityProcessor Network Activity Block Size	300	0		False			True
	哈希传递攻击可疑活动		Microsoft.AdvancedThreatAnalytics.1_7.Center.PassTheHashSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	票证传递攻击可疑活动		Microsoft.AdvancedThreatAnalytics.1_7.Center.PassTheTicketSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	远程执行可疑活动		Microsoft.AdvancedThreatAnalytics.1_7.Center.RemoteExecutionSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	检索数据保护备份密钥可疑活动		Microsoft.AdvancedThreatAnalytics.1_7.Center.RetrieveDataProtectionBackupKeySuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	SAMR 侦测可疑活动		Microsoft.AdvancedThreatAnalytics.1_7.Center.SamrReconnaissanceSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Syslog 监视警报		Microsoft.AdvancedThreatAnalytics.1_7.Center.SyslogMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	ATA 网关未能针对域控制器进行身份验证	监视 Microsoft ATA 1.7 网关的规则 - ATA 网关未能针对域控制器进行身份验证	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.ActiveDirectoryAuthenticationFailure	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	注册表中可能禁用计数器	监视 Microsoft ATA 1.7 网关的规则 - 注册表中可能禁用计数器	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.CountersDisabled	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	EntityResolver 活动块大小	排队等待解决方案的网络活动(NA)的数量	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.EntityResolverActivityBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	EntityResolver Activity Block Size	300	0		False			True
	EntitySender 实体批块大小	排队等待被发送至 ATA 中心的网络活动(NA)的数量	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.EntitySenderEntityBatchBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	EntitySender Entity Batch Block Size	300	0		False			True
	EntitySender 实体批处理发送时间	发送上一批所用的时间	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.EntitySenderEntityBatchSendTime	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	EntitySender Entity Batch Send Time	300	0		False			True
	ATA 网关未能针对中心进行身份验证	监视 Microsoft ATA 1.7 网关的规则 - ATA 网关未能针对中心进行身份验证	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToAuthenticateAgainstCenter	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA 网关未能建立与 ATA 中心的连接	监视 Microsoft ATA 1.7 网关的规则 - ATA 网关未能建立与 ATA 中心的连接	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToEstablishConnectionToCenter	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA 网关未能分析 SIEM Syslog 消息	监视 Microsoft ATA 1.7 网关的规则 - ATA 网关未能分析 SIEM Syslog 消息	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToParseSyslog	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA 网关未能使用 LDAP 协议查询域控制器	监视 Microsoft ATA 1.7 网关的规则 - ATA 网关未能使用 LDAP 协议查询域控制器	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToQueryDCUsingLDAPProtocol	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA 网关未能从 ATA 中心同步配置	监视 Microsoft ATA 1.7 网关的规则 - ATA 网关未能从 ATA 中心同步配置	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToSynchronizeConfigurationFromCenter	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA 网关未能验证中心证书链	监视 Microsoft ATA 1.7 网关的规则 - ATA 网关未能验证中心证书链	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToValidateCenterCertificateChain	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA 网关内存不足	监视 Microsoft ATA 1.7 网关的规则 - ATA 网关内存不足	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.GatewayDoesNotHaveEnoughMemory	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	GatewayUpdaterResourceManager 提交内存最大大小	轻型网关进程可使用的提交内存的最大值(以字节为单位)	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.GatewayUpdaterResourceManagerCommitMemoryMaxSize	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway Updater	GatewayUpdaterResourceManager Commit Memory Max Size	300	0		False			True
	GatewayUpdaterResourceManager CPU 时间最大 \%	轻型网关进程可使用的 CPU 时间的最大值(以百分比表示)	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.GatewayUpdaterResourceManagerCPUTimeMax_	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway Updater	GatewayUpdaterResourceManager CPU Time Max \%	300	0		False			True
	GatewayUpdaterResourceManager 工作集限制大小	轻型网关进程可使用的物理内存的最大值(以字节为单位)	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.GatewayUpdaterResourceManagerWorkingSetLimitSize	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway Updater	GatewayUpdaterResourceManager Working Set Limit Size	300	0		False			True
	HOSTS 文件中包含一个指向计算机简称的主机条目	监视 Microsoft ATA 1.7 网关的规则 - HOSTS 文件中包含一个指向计算机简称的主机条目	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.HostEntryInHOSTSFile	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	已在 ATA 网关安装消息分析器	监视 Microsoft ATA 1.7 网关的规则 - 消息分析器安装于 ATA 网关上	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.MessageAnalyzerIsInstalledOnGateway	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	NetworkActivityTranslator 消息数据 0 块大小	排队等待转换为网络活动(NA)的流量	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkActivityTranslatorMessageData0BlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkActivityTranslator Message Data 0 Block Size	300	0		False			True
	NetworkActivityTranslator 消息数据 1 块大小	排队等待转换为网络活动(NA)的流量	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkActivityTranslatorMessageData1BlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkActivityTranslator Message Data 1 Block Size	300	0		False			True
	NetworkActivityTranslator 消息数据 2 块大小	排队等待转换为网络活动(NA)的流量	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkActivityTranslatorMessageData2BlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkActivityTranslator Message Data 2 Block Size	300	0		False			True
	NetworkListener ETW 丢弃事件数/秒	ATA 网关每秒丢弃的流量	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkListenerETWDroppedEvents_Sec	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkListener ETW Dropped Events/Sec	300	0		False			True
	NetworkListener PEF 丢弃事件数/秒	ATA 网关每秒丢弃的流量	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkListenerPEFDroppedEvents_Sec	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkListener PEF Dropped Events/Sec	300	0		False			True
	NetworkListener PEF 分析消息数/秒	ATA 网关每秒处理的流量	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkListenerPEFParsedMessages_Sec	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkListener PEF Parsed Messages/Sec	300	0		False			True
	计算机上存在其他挂起的安装	监视 Microsoft ATA 1.7 网关的规则 - 计算机上存在其他挂起的安装	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.OtherPendingInstallations	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	PEF (消息分析器)未正确安装	监视 Microsoft ATA 1.7 网关的规则 - PEF (消息分析器)未正确安装	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.PEFWasNotInstalledCorrectly	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	已针对 ATA 网关中的进程名称启用 PID	监视 Microsoft ATA 1.7 网关的规则 - 已针对 ATA 网关中的进程名称启用 PID	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.PIDsWasEnabledForProcessNamesInGateway	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True