All Rules in Microsoft.AdvancedThreatAnalytics.1_7 Management Pack

	DisplayName	Description	ID	Target	Category	Enabled	Instance Name	Counter Name	Frequency	Event_ID	Event Source	Alert Generate	Alert Severity	Alert Priority	Remotable	Event Log
	Abnormal Behavior Suspicious Activity Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.AbnormalBehaviorSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Abnormal SMB Suspicious Activity Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.AbnormalSmbSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Account Enumeration Suspicious Activity Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.AccountEnumerationSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Brute Force Suspicious Activity Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.BruteForceSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	ATA 1.7 - Center Database Data Drive Free Space Monitoring Alert Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.CenterDatabaseDataDriveFreeSpaceMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	ATA 1.7 - Center Overloaded Monitoring Alert Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.CenterOverloadedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	ATA 1.7 - Certificate Expiry Monitoring Alert Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.CertificateExpiryMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Computer Pre-Authentication Failed Suspicious Activity Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.ComputerPreauthenticationFailedSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Database AtSVC Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseAtSvcBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database AtSVC Block Size	300	0		False			True
	Database DirectoryServicesActivity Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseDirectoryServicesActivityBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database DirectoryServicesActivity Block Size	300	0		False			True
	ATA 1.7 - Database Disconnected Monitoring Alert Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseDisconnectedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Database DNS Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseDnsBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database DNS Block Size	300	0		False			True
	Database DRSR Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseDrsrBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database DRSR Block Size	300	0		False			True
	Database KerberosAP Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseKerberosApBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database KerberosAP Block Size	300	0		False			True
	Database KerberosAS Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseKerberosAsBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database KerberosAS Block Size	300	0		False			True
	Database KerberosTGS Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseKerberosTgsBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database KerberosTGS Block Size	300	0		False			True
	Database LDAP Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseLdapBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database LDAP Block Size	300	0		False			True
	Database LsaRPC Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseLsaRpcBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database LsaRPC Block Size	300	0		False			True
	Database Netlogon Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseNetlogonBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database Netlogon Block Size	300	0		False			True
	Database NTLM Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseNtlmBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database NTLM Block Size	300	0		False			True
	Database NTLMEvent Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseNtlmEventBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database NTLMEvent Block Size	300	0		False			True
	Database ServiceControl Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseServiceControlBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database ServiceControl Block Size	300	0		False			True
	Database SMB Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseSmbBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database SMB Block Size	300	0		False			True
	Database SrvSVC Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseSrvSvcBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database SrvSVC Block Size	300	0		False			True
	Database TaskScheduler Block Size	The number of Network Activities of a specific type queued to be written to the database	Microsoft.AdvancedThreatAnalytics.1_7.Center.DatabaseTaskSchedulerBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	Database TaskScheduler Block Size	300	0		False			True
	ATA 1.7 - Directory Services Client Account Password Expiry Monitoring Alert Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.DirectoryServicesClientAccountPasswordExpiryMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Directory Services Replication Suspicious Activity Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.DirectoryServicesReplicationSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	DNS Reconnaissance Suspicious Activity Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.DnsReconnaissanceSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	ATA 1.7 - Domain Synchronizer Not Assigned Monitoring Alert Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.DomainSynchronizerNotAssignedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Encryption Downgrade Suspicious Activity Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.EncryptionDowngradeSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Encryption Downgrade Suspicious Activity (Golden Ticket) Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.EncryptionDowngradeSuspiciousActivity_GoldenTicket	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Encryption Downgrade Suspicious Activity (Overpass the Hash) Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.EncryptionDowngradeSuspiciousActivity_OverpasstheHash	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Encryption Downgrade Suspicious Activity (Skeleton Key) Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.EncryptionDowngradeSuspiciousActivity_SkeletonKey	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	EntityProfiler Network Activity Block Size	The number of Network Activities (NAs) queued for profiling	Microsoft.AdvancedThreatAnalytics.1_7.Center.EntityProfilerNetworkActivityBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	EntityProfiler Network Activity Block Size	300	0		False			True
	EntityReceiver Entity Batch Block Size	The number of entity batches queued by the ATA Center	Microsoft.AdvancedThreatAnalytics.1_7.Center.EntityReceiverEntityBatchBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	EntityReceiver Entity Batch Block Size	300	0		False			True
	Enumerate Sessions Suspicious Activity Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.EnumerateSessionsSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Forged Pac Suspicious Activity Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.ForgedPacSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	ATA 1.7 - Gateway Capture Network Adapter Faulted Monitoring Alert Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayCaptureNetworkAdapterFaultedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	ATA 1.7 - Gateway Capture Network Adapter Missing Monitoring Alert Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayCaptureNetworkAdapterMissingMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	ATA 1.7 - Gateway Directory Services Client Connectivity Monitoring Alert Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayDirectoryServicesClientConnectivityMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	ATA 1.7 - Gateway Disconnected Monitoring Alert Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayDisconnectedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	ATA 1.7 - Gateway Low Memory Monitoring Alert Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayLowMemoryMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	ATA 1.7 - Gateway Not Receiving Traffic Monitoring Alert Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayNotReceivingTrafficMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	ATA 1.7 - Gateway Overloaded Event Activities Monitoring Alert Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayOverloadedEventActivitiesMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	ATA 1.7 - Gateway Overloaded Network Activities Monitoring Alert Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayOverloadedNetworkActivitiesMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	ATA 1.7 - Gateways Outdated Monitoring Alert Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewaysOutdatedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	ATA 1.7 - Gateway Start Failure Monitoring Alert Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.GatewayStartFailureMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Honeytoken Activity Suspicious Activity Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.HoneytokenActivitySuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	LDAP Simple Bind Cleartext Password Suspicious Activity Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.LdapSimpleBindCleartextPasswordSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	ATA 1.7 - Mail Monitoring Alert Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.MailMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Massive Object Deletion Suspicious Activity Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.MassiveObjectDeletionSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	NetworkActivityProcessor Network Activity Block Size	The number of Network Activities (NAs) queued for processing	Microsoft.AdvancedThreatAnalytics.1_7.Center.NetworkActivityProcessorNetworkActivityBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Center	PerformanceCollection	True	Microsoft ATA Center	NetworkActivityProcessor Network Activity Block Size	300	0		False			True
	Pass The Hash Suspicious Activity Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.PassTheHashSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Pass The Ticket Suspicious Activity Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.PassTheTicketSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Remote Execution Suspicious Activity Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.RemoteExecutionSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Retrieve Data Protection Backup Key Suspicious Activity Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.RetrieveDataProtectionBackupKeySuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	SAMR Reconnaissance Suspicious Activity Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.SamrReconnaissanceSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_7.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	ATA 1.7 - Syslog Monitoring Alert Alert Rule		Microsoft.AdvancedThreatAnalytics.1_7.Center.SyslogMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_7.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	ATA Gateway Failed to Authenticate Against the Domain Controller	Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway Failed to Authenticate Against the Domain Controller	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.ActiveDirectoryAuthenticationFailure	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	Counters might be disabled in the registry	Rule to monitor Microsoft ATA 1.7 Gateway - Counters might be disabled in the registry	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.CountersDisabled	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	EntityResolver Activity Block Size	The amount of Network Activities (NAs) queued for resolution	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.EntityResolverActivityBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	EntityResolver Activity Block Size	300	0		False			True
	EntitySender Entity Batch Block Size	The amount of Network Activities (NAs) queued to be sent to the ATA Center	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.EntitySenderEntityBatchBlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	EntitySender Entity Batch Block Size	300	0		False			True
	EntitySender Entity Batch Send Time	The amount of time it took to send the last batch	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.EntitySenderEntityBatchSendTime	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	EntitySender Entity Batch Send Time	300	0		False			True
	ATA Gateway Failed to Authenticate Against Center	Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway Failed to Authenticate Against Center	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToAuthenticateAgainstCenter	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA Gateway failed to establish connection to the ATA Center	Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway failed to establish connection to the ATA Center	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToEstablishConnectionToCenter	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA Gateway Failed to Parse SIEM Syslog Message	Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway Failed to Parse SIEM Syslog Message	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToParseSyslog	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA Gateway failed to query the domain controller using the LDAP protocol	Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway failed to query the domain controller using the LDAP protocol	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToQueryDCUsingLDAPProtocol	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA Gateway failed to synchronize the configuration from the ATA Center	Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway failed to synchronize the configuration from the ATA Center	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToSynchronizeConfigurationFromCenter	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA Gateway Failed to Validate Center Certificate Chain	Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway Failed to Validate Center Certificate Chain	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.FailedToValidateCenterCertificateChain	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA Gateway does not have enough memory	Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway does not have enough memory	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.GatewayDoesNotHaveEnoughMemory	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	GatewayUpdaterResourceManager Commit Memory Max Size	The maximum amount of committed memory (in bytes) that the Lightweight Gateway process can consume	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.GatewayUpdaterResourceManagerCommitMemoryMaxSize	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway Updater	GatewayUpdaterResourceManager Commit Memory Max Size	300	0		False			True
	GatewayUpdaterResourceManager CPU Time Max \%	The maximum amount of CPU time (in percentage) that the Lightweight Gateway process can consume	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.GatewayUpdaterResourceManagerCPUTimeMax_	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway Updater	GatewayUpdaterResourceManager CPU Time Max \%	300	0		False			True
	GatewayUpdaterResourceManager Working Set Limit Size	The Maximum amount of physical memory (in bytes) that the Lightweight Gateway process can consume	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.GatewayUpdaterResourceManagerWorkingSetLimitSize	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway Updater	GatewayUpdaterResourceManager Working Set Limit Size	300	0		False			True
	There is a host entry in the HOSTS file pointing to the machine's shortname	Rule to monitor Microsoft ATA 1.7 Gateway - There is a host entry in the HOSTS file pointing to the machine's shortname	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.HostEntryInHOSTSFile	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	Message Analyzer is installed on the ATA Gateway	Rule to monitor Microsoft ATA 1.7 Gateway - Message Analyzer is installed on the ATA Gateway	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.MessageAnalyzerIsInstalledOnGateway	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	NetworkActivityTranslator Message Data 0 Block Size	The amount of traffic queued for translation to Network Activities (NAs)	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkActivityTranslatorMessageData0BlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkActivityTranslator Message Data 0 Block Size	300	0		False			True
	NetworkActivityTranslator Message Data 1 Block Size	The amount of traffic queued for translation to Network Activities (NAs)	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkActivityTranslatorMessageData1BlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkActivityTranslator Message Data 1 Block Size	300	0		False			True
	NetworkActivityTranslator Message Data 2 Block Size	The amount of traffic queued for translation to Network Activities (NAs)	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkActivityTranslatorMessageData2BlockSize	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkActivityTranslator Message Data 2 Block Size	300	0		False			True
	NetworkListener ETW Dropped Events/Sec	The amount of traffic being dropped by the ATA Gateway every second	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkListenerETWDroppedEvents_Sec	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkListener ETW Dropped Events/Sec	300	0		False			True
	NetworkListener PEF Dropped Events/Sec	The amount of traffic being dropped by the ATA Gateway every second	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkListenerPEFDroppedEvents_Sec	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkListener PEF Dropped Events/Sec	300	0		False			True
	NetworkListener PEF Parsed Messages/Sec	The amount of traffic being processed by the ATA Gateway every second	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.NetworkListenerPEFParsedMessages_Sec	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkListener PEF Parsed Messages/Sec	300	0		False			True
	There are other pending installations on your computer	Rule to monitor Microsoft ATA 1.7 Gateway - There are other pending installations on your computer	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.OtherPendingInstallations	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	PEF (Message Analyzer) was not installed correctly	Rule to monitor Microsoft ATA 1.7 Gateway - PEF (Message Analyzer) was not installed correctly	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.PEFWasNotInstalledCorrectly	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	PIDs was enabled for process names in the ATA Gateway	Rule to monitor Microsoft ATA 1.7 Gateway - PIDs was enabled for process names in the ATA Gateway	Microsoft.AdvancedThreatAnalytics.1_7.Gateway.PIDsWasEnabledForProcessNamesInGateway	Microsoft.AdvancedThreatAnalytics.1_7.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True