All Rules in Microsoft.AdvancedThreatAnalytics.1_7 Management Pack

	DisplayName	Description	ID	Target	Category	Enabled	Instance Name	Counter Name	Frequency	Event_ID	Event Source	Alert Generate	Alert Severity	Alert Priority	Remotable	Event Log
	Abnormal Behavior Suspicious Activity	Rule to monitor Microsoft ATA 1.7 Center - EventID 2001 - Abnormal Behavior Suspicious Activity	Microsoft.AdvancedThreatAnalytics.1_7.Center.AbnormalBehaviorSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Warning	Normal	True
	Abnormal SMB Suspicious Activity	Rule to monitor Microsoft ATA 1.7 Center - EventID 2002 - Abnormal SMB Suspicious Activity	Microsoft.AdvancedThreatAnalytics.1_7.Center.AbnormalSmbSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True
	Account Enumeration Suspicious Activity	Rule to monitor Microsoft ATA 1.7 Center - EventID 2003 - Account Enumeration Suspicious Activity	Microsoft.AdvancedThreatAnalytics.1_7.Center.AccountEnumerationSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True
	Brute Force Suspicious Activity	Rule to monitor Microsoft ATA 1.7 Center - EventID 2004 - Brute Force Suspicious Activity	Microsoft.AdvancedThreatAnalytics.1_7.Center.BruteForceSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True
	Center Database Data Drive Free Space Monitoring Alert	Rule to monitor Microsoft ATA 1.7 Center - EventID 1001 - Center Database Data Drive Free Space Monitoring Alert	Microsoft.AdvancedThreatAnalytics.1_7.Center.CenterDatabaseDataDriveFreeSpaceMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True
	Center Overloaded Monitoring Alert	Rule to monitor Microsoft ATA 1.7 Center - EventID 1003 - Center Overloaded Monitoring Alert	Microsoft.AdvancedThreatAnalytics.1_7.Center.CenterOverloadedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceHealth	True			0	0		True	Warning	Normal	True
	Certificate Expiry Monitoring Alert	Rule to monitor Microsoft ATA 1.7 Center - EventID 1004 - Certificate Expiry Monitoring Alert	Microsoft.AdvancedThreatAnalytics.1_7.Center.CertificateExpiryMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True
	Computer Pre-Authentication Failed Suspicious Activity	Rule to monitor Microsoft ATA 1.7 Center - EventID 2005 - Computer Pre-Authentication Failed Suspicious Activity	Microsoft.AdvancedThreatAnalytics.1_7.Center.ComputerPreauthenticationFailedSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True
	Database AtSVC Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseAtSvcBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database AtSVC Block Size	300	0		False			True
	Database DirectoryServicesActivity Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseDirectoryServicesActivityBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database DirectoryServicesActivity Block Size	300	0		False			True
	Database Disconnected Monitoring Alert	Rule to monitor Microsoft ATA 1.7 Center - EventID 1005 - Database Disconnected Monitoring Alert	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseDisconnectedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True
	Database DNS Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseDnsBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database DNS Block Size	300	0		False			True
	Database DRSR Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseDrsrBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database DRSR Block Size	300	0		False			True
	Database KerberosAP Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseKerberosApBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database KerberosAP Block Size	300	0		False			True
	Database KerberosAS Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseKerberosAsBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database KerberosAS Block Size	300	0		False			True
	Database KerberosTGS Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseKerberosTgsBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database KerberosTGS Block Size	300	0		False			True
	Database LDAP Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseLdapBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database LDAP Block Size	300	0		False			True
	Database LsaRPC Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseLsaRpcBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database LsaRPC Block Size	300	0		False			True
	Database Netlogon Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseNetlogonBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database Netlogon Block Size	300	0		False			True
	Database NTLM Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseNtlmBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database NTLM Block Size	300	0		False			True
	Database NTLMEvent Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseNtlmEventBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database NTLMEvent Block Size	300	0		False			True
	Database ServiceControl Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseServiceControlBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database ServiceControl Block Size	300	0		False			True
	Database SMB Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseSmbBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database SMB Block Size	300	0		False			True
	Database SrvSVC Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseSrvSvcBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database SrvSVC Block Size	300	0		False			True
	Database TaskScheduler Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseTaskSchedulerBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database TaskScheduler Block Size	300	0		False			True
	Directory Services Client Account Password Expiry Monitoring Alert	Rule to monitor Microsoft ATA 1.7 Center - EventID 1006 - Directory Services Client Account Password Expiry Monitoring Alert	Microsoft.AdvancedThreatAnalytics.1_7.Center.DirectoryServicesClientAccountPasswordExpiryMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True
	Directory Services Replication Suspicious Activity	Rule to monitor Microsoft ATA 1.7 Center - EventID 2006 - Directory Services Replication Suspicious Activity	Microsoft.AdvancedThreatAnalytics.1_7.Center.DirectoryServicesReplicationSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True
	DNS Reconnaissance Suspicious Activity	Rule to monitor Microsoft ATA 1.7 Center - EventID 2007 - DNS Reconnaissance Suspicious Activity	Microsoft.AdvancedThreatAnalytics.1_7.Center.DnsReconnaissanceSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True
	Domain Synchronizer Not Assigned Monitoring Alert	Rule to monitor Microsoft ATA 1.7 Center - EventID 1007 - Domain Synchronizer Not Assigned Monitoring Alert	Microsoft.AdvancedThreatAnalytics.1_7.Center.DomainSynchronizerNotAssignedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True
	Encryption Downgrade Suspicious Activity	Rule to monitor Microsoft ATA 1.7 Center - EventID 2008 - Encryption Downgrade Suspicious Activity	Microsoft.AdvancedThreatAnalytics.1_7.Center.EncryptionDowngradeSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True
	Encryption Downgrade Suspicious Activity (Golden Ticket)	Rule to monitor Microsoft ATA 1.7 Center - EventID 2009 - Encryption Downgrade Suspicious Activity (Golden Ticket)	Microsoft.AdvancedThreatAnalytics.1_7.Center.EncryptionDowngradeSuspiciousActivity_GoldenTicket	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True
	Encryption Downgrade Suspicious Activity (Overpass the Hash)	Rule to monitor Microsoft ATA 1.7 Center - EventID 2010 - Encryption Downgrade Suspicious Activity (Overpass the Hash)	Microsoft.AdvancedThreatAnalytics.1_7.Center.EncryptionDowngradeSuspiciousActivity_OverpasstheHash	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True
	Encryption Downgrade Suspicious Activity (Skeleton Key)	Rule to monitor Microsoft ATA 1.7 Center - EventID 2011 - Encryption Downgrade Suspicious Activity (Skeleton Key)	Microsoft.AdvancedThreatAnalytics.1_7.Center.EncryptionDowngradeSuspiciousActivity_SkeletonKey	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True
	EntityProfiler Network Activity Block Size	The number of Network Activities (NAs) queued for profiling	Microsoft.AdvancedThreatAnalytics.1_7.Center.EntityProfilerNetworkActivityBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	EntityProfiler Network Activity Block Size	300	0		False			True
	EntityReceiver Entity Batch Block Size	The number of entity batches queued by the ATA Center	Microsoft.AdvancedThreatAnalytics.1_7.Center.EntityReceiverEntityBatchBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	EntityReceiver Entity Batch Block Size	300	0		False			True
	Enumerate Sessions Suspicious Activity	Rule to monitor Microsoft ATA 1.7 Center - EventID 2012 - Enumerate Sessions Suspicious Activity	Microsoft.AdvancedThreatAnalytics.1_7.Center.EnumerateSessionsSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True
	Forged Pac Suspicious Activity	Rule to monitor Microsoft ATA 1.7 Center - EventID 2013 - Forged Pac Suspicious Activity	Microsoft.AdvancedThreatAnalytics.1_7.Center.ForgedPacSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True
	Gateway Capture Network Adapter Faulted Monitoring Alert	Rule to monitor Microsoft ATA 1.7 Center - EventID 1008 - Gateway Capture Network Adapter Faulted Monitoring Alert	Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayCaptureNetworkAdapterFaultedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True
	Gateway Capture Network Adapter Missing Monitoring Alert	Rule to monitor Microsoft ATA 1.7 Center - EventID 1009 - Gateway Capture Network Adapter Missing Monitoring Alert	Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayCaptureNetworkAdapterMissingMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True
	Gateway Directory Services Client Connectivity Monitoring Alert	Rule to monitor Microsoft ATA 1.7 Center - EventID 1010 - Gateway Directory Services Client Connectivity Monitoring Alert	Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayDirectoryServicesClientConnectivityMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True
	Gateway Disconnected Monitoring Alert	Rule to monitor Microsoft ATA 1.7 Center - EventID 1011 - Gateway Disconnected Monitoring Alert	Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayDisconnectedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True
	Gateway Low Memory Monitoring Alert	Rule to monitor Microsoft ATA 1.7 Center - EventID 1019 - Gateway Low Memory Monitoring Alert	Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayLowMemoryMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceHealth	True			0	0		True	Warning	Normal	True
	Gateway Not Receiving Traffic Monitoring Alert	Rule to monitor Microsoft ATA 1.7 Center - EventID 1017 - Gateway Not Receiving Traffic Monitoring Alert	Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayNotReceivingTrafficMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True
	Gateway Overloaded Event Activities Monitoring Alert	Rule to monitor Microsoft ATA 1.7 Center - EventID 1012 - Gateway Overloaded Event Activities Monitoring Alert	Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayOverloadedEventActivitiesMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceHealth	True			0	0		True	Warning	Normal	True
	Gateway Overloaded Network Activities Monitoring Alert	Rule to monitor Microsoft ATA 1.7 Center - EventID 1013 - Gateway Overloaded Network Activities Monitoring Alert	Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayOverloadedNetworkActivitiesMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceHealth	True			0	0		True	Warning	Normal	True
	Gateways Outdated Monitoring Alert	Rule to monitor Microsoft ATA 1.7 Center - EventID 1016 - Gateways Outdated Monitoring Alert	Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewaysOutdatedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True
	Gateway Start Failure Monitoring Alert	Rule to monitor Microsoft ATA 1.7 Center - EventID 1018 - Gateway Start Failure Monitoring Alert	Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayStartFailureMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True
	Honeytoken Activity Suspicious Activity	Rule to monitor Microsoft ATA 1.7 Center - EventID 2014 - Honeytoken Activity Suspicious Activity	Microsoft.AdvancedThreatAnalytics.1_7.Center.HoneytokenActivitySuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True
	LDAP Simple Bind Cleartext Password Suspicious Activity	Rule to monitor Microsoft ATA 1.7 Center - EventID 2015 - LDAP Simple Bind Cleartext Password Suspicious Activity	Microsoft.AdvancedThreatAnalytics.1_7.Center.LdapSimpleBindCleartextPasswordSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True
	Mail Monitoring Alert	Rule to monitor Microsoft ATA 1.7 Center - EventID 1014 - Mail Monitoring Alert	Microsoft.AdvancedThreatAnalytics.1_7.Center.MailMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True
	Massive Object Deletion Suspicious Activity	Rule to monitor Microsoft ATA 1.7 Center - EventID 2016 - Massive Object Deletion Suspicious Activity	Microsoft.AdvancedThreatAnalytics.1_7.Center.MassiveObjectDeletionSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True
	NetworkActivityProcessor Network Activity Block Size	The number of Network Activities (NAs) queued for processing	Microsoft.AdvancedThreatAnalytics.1_7.Center.NetworkActivityProcessorNetworkActivityBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	NetworkActivityProcessor Network Activity Block Size	300	0		False			True
	Pass The Hash Suspicious Activity	Rule to monitor Microsoft ATA 1.7 Center - EventID 2017 - Pass The Hash Suspicious Activity	Microsoft.AdvancedThreatAnalytics.1_7.Center.PassTheHashSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True
	Pass The Ticket Suspicious Activity	Rule to monitor Microsoft ATA 1.7 Center - EventID 2018 - Pass The Ticket Suspicious Activity	Microsoft.AdvancedThreatAnalytics.1_7.Center.PassTheTicketSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True
	Remote Execution Suspicious Activity	Rule to monitor Microsoft ATA 1.7 Center - EventID 2019 - Remote Execution Suspicious Activity	Microsoft.AdvancedThreatAnalytics.1_7.Center.RemoteExecutionSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True
	Retrieve Data Protection Backup Key Suspicious Activity	Rule to monitor Microsoft ATA 1.7 Center - EventID 2020 - Retrieve Data Protection Backup Key Suspicious Activity	Microsoft.AdvancedThreatAnalytics.1_7.Center.RetrieveDataProtectionBackupKeySuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True
	SAMR Reconnaissance Suspicious Activity	Rule to monitor Microsoft ATA 1.7 Center - EventID 2021 - SAMR Reconnaissance Suspicious Activity	Microsoft.AdvancedThreatAnalytics.1_7.Center.SamrReconnaissanceSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True
	Syslog Monitoring Alert	Rule to monitor Microsoft ATA 1.7 Center - EventID 1015 - Syslog Monitoring Alert	Microsoft.AdvancedThreatAnalytics.1_7.Center.SyslogMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True
	ATA Gateway Failed to Authenticate Against the Domain Controller	Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway Failed to Authenticate Against the Domain Controller	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.ActiveDirectoryAuthenticationFailure	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	Counters might be disabled in the registry	Rule to monitor Microsoft ATA 1.7 Gateway - Counters might be disabled in the registry	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.CountersDisabled	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	EntityResolver Activity Block Size	The amount of Network Activities (NAs) queued for resolution	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.EntityResolverActivityBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	EntityResolver Activity Block Size	300	0		False			True
	EntitySender Entity Batch Block Size	The amount of Network Activities (NAs) queued to be sent to the ATA Center	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.EntitySenderEntityBatchBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	EntitySender Entity Batch Block Size	300	0		False			True
	EntitySender Entity Batch Send Time	The amount of time it took to send the last batch	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.EntitySenderEntityBatchSendTime	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	EntitySender Entity Batch Send Time	300	0		False			True
	ATA Gateway Failed to Authenticate Against Center	Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway Failed to Authenticate Against Center	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToAuthenticateAgainstCenter	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA Gateway failed to establish connection to the ATA Center	Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway failed to establish connection to the ATA Center	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToEstablishConnectionToCenter	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA Gateway Failed to Parse SIEM Syslog Message	Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway Failed to Parse SIEM Syslog Message	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToParseSyslog	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA Gateway failed to query the domain controller using the LDAP protocol	Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway failed to query the domain controller using the LDAP protocol	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToQueryDCUsingLDAPProtocol	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA Gateway failed to synchronize the configuration from the ATA Center	Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway failed to synchronize the configuration from the ATA Center	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToSynchronizeConfigurationFromCenter	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA Gateway Failed to Validate Center Certificate Chain	Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway Failed to Validate Center Certificate Chain	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToValidateCenterCertificateChain	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA Gateway does not have enough memory	Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway does not have enough memory	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.GatewayDoesNotHaveEnoughMemory	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	GatewayUpdaterResourceManager Commit Memory Max Size	The maximum amount of committed memory (in bytes) that the Lightweight Gateway process can consume	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.GatewayUpdaterResourceManagerCommitMemoryMaxSize	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway Updater	GatewayUpdaterResourceManager Commit Memory Max Size	300	0		False			True
	GatewayUpdaterResourceManager CPU Time Max \%	The maximum amount of CPU time (in percentage) that the Lightweight Gateway process can consume	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.GatewayUpdaterResourceManagerCPUTimeMax_	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway Updater	GatewayUpdaterResourceManager CPU Time Max \%	300	0		False			True
	GatewayUpdaterResourceManager Working Set Limit Size	The Maximum amount of physical memory (in bytes) that the Lightweight Gateway process can consume	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.GatewayUpdaterResourceManagerWorkingSetLimitSize	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway Updater	GatewayUpdaterResourceManager Working Set Limit Size	300	0		False			True
	There is a host entry in the HOSTS file pointing to the machine's shortname	Rule to monitor Microsoft ATA 1.7 Gateway - There is a host entry in the HOSTS file pointing to the machine's shortname	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.HostEntryInHOSTSFile	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	Message Analyzer is installed on the ATA Gateway	Rule to monitor Microsoft ATA 1.7 Gateway - Message Analyzer is installed on the ATA Gateway	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.MessageAnalyzerIsInstalledOnGateway	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	NetworkActivityTranslator Message Data 0 Block Size	The amount of traffic queued for translation to Network Activities (NAs)	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkActivityTranslatorMessageData0BlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkActivityTranslator Message Data 0 Block Size	300	0		False			True
	NetworkActivityTranslator Message Data 1 Block Size	The amount of traffic queued for translation to Network Activities (NAs)	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkActivityTranslatorMessageData1BlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkActivityTranslator Message Data 1 Block Size	300	0		False			True
	NetworkActivityTranslator Message Data 2 Block Size	The amount of traffic queued for translation to Network Activities (NAs)	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkActivityTranslatorMessageData2BlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkActivityTranslator Message Data 2 Block Size	300	0		False			True
	NetworkListener ETW Dropped Events/Sec	The amount of traffic being dropped by the ATA Gateway every second	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkListenerETWDroppedEvents_Sec	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkListener ETW Dropped Events/Sec	300	0		False			True
	NetworkListener PEF Dropped Events/Sec	The amount of traffic being dropped by the ATA Gateway every second	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkListenerPEFDroppedEvents_Sec	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkListener PEF Dropped Events/Sec	300	0		False			True
	NetworkListener PEF Parsed Messages/Sec	The amount of traffic being processed by the ATA Gateway every second	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkListenerPEFParsedMessages_Sec	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkListener PEF Parsed Messages/Sec	300	0		False			True
	There are other pending installations on your computer	Rule to monitor Microsoft ATA 1.7 Gateway - There are other pending installations on your computer	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.OtherPendingInstallations	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	PEF (Message Analyzer) was not installed correctly	Rule to monitor Microsoft ATA 1.7 Gateway - PEF (Message Analyzer) was not installed correctly	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.PEFWasNotInstalledCorrectly	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	PIDs was enabled for process names in the ATA Gateway	Rule to monitor Microsoft ATA 1.7 Gateway - PIDs was enabled for process names in the ATA Gateway	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.PIDsWasEnabledForProcessNamesInGateway	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True