All Rules in Microsoft.AdvancedThreatAnalytics.1_8 Management Pack

	DisplayName	Description	ID	Target	Category	Enabled	Instance Name	Counter Name	Frequency	Event_ID	Event Source	Alert Generate	Alert Severity	Alert Priority	Remotable	Event Log
	Abnormal Behavior Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.AbnormalBehaviorSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Abnormal Protocol Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.AbnormalProtocolSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Abnormal Sensitive Group Membership Change Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.AbnormalSensitiveGroupMembershipChangeSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Abnormal Vpn Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.AbnormalVpnSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Account Enumeration Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.AccountEnumerationSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Brute Force Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.BruteForceSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Center Database Data Drive Free Space Monitoring Alert Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.CenterDatabaseDataDriveFreeSpaceMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_8.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Center Database Disconnected Monitoring Alert Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.CenterDatabaseDisconnectedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_8.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Center External Ip Address Resolution Failure Monitoring Alert Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.CenterExternalIpAddressResolutionFailureMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_8.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Center Mail Monitoring Alert Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.CenterMailMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_8.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Center Not Receiving Traffic Monitoring Alert Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.CenterNotReceivingTrafficMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_8.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Center Overloaded Monitoring Alert Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.CenterOverloadedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Center Syslog Monitoring Alert Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.CenterSyslogMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_8.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Certificate Expiry Monitoring Alert Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.CertificateExpiryMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_8.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Computer Pre-Authentication Failed Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.ComputerPreauthenticationFailedSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Database AtSVC Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Center.DatabaseAtSvcBlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceCollection	True	Microsoft ATA Center	Database AtSVC Block Size	300	0		False			True
	Database DirectoryServicesActivity Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Center.DatabaseDirectoryServicesActivityBlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceCollection	True	Microsoft ATA Center	Database DirectoryServicesActivity Block Size	300	0		False			True
	Database DNS Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Center.DatabaseDnsBlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceCollection	True	Microsoft ATA Center	Database DNS Block Size	300	0		False			True
	Database DRSR Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Center.DatabaseDrsrBlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceCollection	True	Microsoft ATA Center	Database DRSR Block Size	300	0		False			True
	Database KerberosAP Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Center.DatabaseKerberosApBlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceCollection	True	Microsoft ATA Center	Database KerberosAP Block Size	300	0		False			True
	Database KerberosAS Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Center.DatabaseKerberosAsBlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceCollection	True	Microsoft ATA Center	Database KerberosAS Block Size	300	0		False			True
	Database KerberosTGS Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Center.DatabaseKerberosTgsBlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceCollection	True	Microsoft ATA Center	Database KerberosTGS Block Size	300	0		False			True
	Database LDAP Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Center.DatabaseLdapBlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceCollection	True	Microsoft ATA Center	Database LDAP Block Size	300	0		False			True
	Database LsaRPC Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Center.DatabaseLsaRpcBlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceCollection	True	Microsoft ATA Center	Database LsaRPC Block Size	300	0		False			True
	Database Netlogon Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Center.DatabaseNetlogonBlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceCollection	True	Microsoft ATA Center	Database Netlogon Block Size	300	0		False			True
	Database NTLM Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Center.DatabaseNtlmBlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceCollection	True	Microsoft ATA Center	Database NTLM Block Size	300	0		False			True
	Database NTLMEvent Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Center.DatabaseNtlmEventBlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceCollection	True	Microsoft ATA Center	Database NTLMEvent Block Size	300	0		False			True
	Database ServiceControl Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Center.DatabaseServiceControlBlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceCollection	True	Microsoft ATA Center	Database ServiceControl Block Size	300	0		False			True
	Database SMB Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Center.DatabaseSmbBlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceCollection	True	Microsoft ATA Center	Database SMB Block Size	300	0		False			True
	Database SrvSVC Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Center.DatabaseSrvSvcBlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceCollection	True	Microsoft ATA Center	Database SrvSVC Block Size	300	0		False			True
	Database TaskScheduler Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Center.DatabaseTaskSchedulerBlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceCollection	True	Microsoft ATA Center	Database TaskScheduler Block Size	300	0		False			True
	Directory Services Replication Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.DirectoryServicesReplicationSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	DNS Reconnaissance Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.DnsReconnaissanceSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Encryption Downgrade-Golden Ticket Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.EncryptionDowngradeGoldenTicketSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Encryption Downgrade-Over Pass-the-Hash Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.EncryptionDowngradeOverPasstheHashSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Encryption Downgrade-Skeleton Key Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.EncryptionDowngradeSkeletonKeySuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Encryption Downgrade Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.EncryptionDowngradeSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	EntityProfiler Network Activity Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Center.EntityProfilerNetworkActivityBlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceCollection	True	Microsoft ATA Center	EntityProfiler Network Activity Block Size	300	0		False			True
	EntityReceiver Entity Batch Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Center.EntityReceiverEntityBatchBlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceCollection	True	Microsoft ATA Center	EntityReceiver Entity Batch Block Size	300	0		False			True
	Enumerate Sessions Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.EnumerateSessionsSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Forged Pac Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.ForgedPacSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Gateway Capture Network Adapter Faulted Monitoring Alert Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.GatewayCaptureNetworkAdapterFaultedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_8.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Gateway Capture Network Adapter Missing Monitoring Alert Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.GatewayCaptureNetworkAdapterMissingMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_8.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Gateway Directory Services Client Account Password Expiry Monitoring Alert Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.GatewayDirectoryServicesClientAccountPasswordExpiryMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_8.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Gateway Directory Services Client Connectivity Monitoring Alert Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.GatewayDirectoryServicesClientConnectivityMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_8.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Gateway Disconnected Monitoring Alert Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.GatewayDisconnectedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_8.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Gateway Domain Synchronizer Not Assigned Monitoring Alert Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.GatewayDomainSynchronizerNotAssignedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_8.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Gateway Low Memory Monitoring Alert Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.GatewayLowMemoryMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Gateway Overloaded Event Activities Monitoring Alert Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.GatewayOverloadedEventActivitiesMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Gateway Overloaded Network Activities Monitoring Alert Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.GatewayOverloadedNetworkActivitiesMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Gateway Radius Event Listener Monitoring Alert Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.GatewayRadiusEventListenerMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_8.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Gateways Outdated Monitoring Alert Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.GatewaysOutdatedMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_8.Center	ConfigurationHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Gateway Start Failure Monitoring Alert Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.GatewayStartFailureMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_8.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Gateway Syslog Event Listener Monitoring Alert Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.GatewaySyslogEventListenerMonitoringAlert	Microsoft.AdvancedThreatAnalytics.1_8.Center	AvailabilityHealth	True			0	0		True	Warning	Normal	True	Microsoft ATA
	Golden Ticket Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.GoldenTicketSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Honeytoken Activity Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.HoneytokenActivitySuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Ldap Brute Force Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.LdapBruteForceSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Ldap Cleartext Password Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.LdapCleartextPasswordSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Massive Object Deletion Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.MassiveObjectDeletionSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	NetworkActivityProcessor Network Activity Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Center.NetworkActivityProcessorNetworkActivityBlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Center	PerformanceCollection	True	Microsoft ATA Center	NetworkActivityProcessor Network Activity Block Size	300	0		False			True
	Pass The Hash Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.PassTheHashSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Pass The Ticket Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.PassTheTicketSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Remote Execution Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.RemoteExecutionSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	Retrieve Data Protection Backup Key Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.RetrieveDataProtectionBackupKeySuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	SAMR Reconnaissance Suspicious Activity Rule		Microsoft.AdvancedThreatAnalytics.1_8.Center.SamrReconnaissanceSuspiciousActivity	Microsoft.AdvancedThreatAnalytics.1_8.Center	SecurityHealth	False			0	0		True	Error	Normal	True	Microsoft ATA
	ATA Gateway Failed to Authenticate Against the Domain Controller	Rule to monitor Microsoft ATA 1.8 Gateway - ATA Gateway Failed to Authenticate Against the Domain Controller	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.ActiveDirectoryAuthenticationFailure	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	Counters might be disabled in the registry	Rule to monitor Microsoft ATA 1.8 Gateway - Counters might be disabled in the registry	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.CountersDisabled	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	EntityResolver Activity Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.EntityResolverActivityBlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	EntityResolver Activity Block Size	300	0		False			True
	EntitySender Entity Batch Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.EntitySenderEntityBatchBlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	EntitySender Entity Batch Block Size	300	0		False			True
	EntitySender Entity Batch Send Time	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.EntitySenderEntityBatchSendTime	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	EntitySender Entity Batch Send Time	300	0		False			True
	ATA Gateway Failed to Authenticate Against Center	Rule to monitor Microsoft ATA 1.8 Gateway - ATA Gateway Failed to Authenticate Against Center	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.FailedToAuthenticateAgainstCenter	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA Gateway failed to establish connection to the ATA Center	Rule to monitor Microsoft ATA 1.8 Gateway - ATA Gateway failed to establish connection to the ATA Center	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.FailedToEstablishConnectionToCenter	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA Gateway Failed to Parse SIEM Syslog Message	Rule to monitor Microsoft ATA 1.8 Gateway - ATA Gateway Failed to Parse SIEM Syslog Message	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.FailedToParseSyslog	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA Gateway failed to query the domain controller using the LDAP protocol	Rule to monitor Microsoft ATA 1.8 Gateway - ATA Gateway failed to query the domain controller using the LDAP protocol	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.FailedToQueryDCUsingLDAPProtocol	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA Gateway failed to synchronize the configuration from the ATA Center	Rule to monitor Microsoft ATA 1.8 Gateway - ATA Gateway failed to synchronize the configuration from the ATA Center	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.FailedToSynchronizeConfigurationFromCenter	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA Gateway Failed to Validate Center Certificate Chain	Rule to monitor Microsoft ATA 1.8 Gateway - ATA Gateway Failed to Validate Center Certificate Chain	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.FailedToValidateCenterCertificateChain	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	ATA Gateway does not have enough memory	Rule to monitor Microsoft ATA 1.8 Gateway - ATA Gateway does not have enough memory	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.GatewayDoesNotHaveEnoughMemory	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	GatewayUpdaterResourceManager Commit Memory Max Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.GatewayUpdaterResourceManagerCommitMemoryMaxSize	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	PerformanceCollection	True	Microsoft ATA Gateway Updater	GatewayUpdaterResourceManager Commit Memory Max Size	300	0		False			True
	GatewayUpdaterResourceManager CPU Time Max \%	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.GatewayUpdaterResourceManagerCPUTimeMax_	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	PerformanceCollection	True	Microsoft ATA Gateway Updater	GatewayUpdaterResourceManager CPU Time Max \%	300	0		False			True
	GatewayUpdaterResourceManager Working Set Limit Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.GatewayUpdaterResourceManagerWorkingSetLimitSize	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	PerformanceCollection	True	Microsoft ATA Gateway Updater	GatewayUpdaterResourceManager Working Set Limit Size	300	0		False			True
	There is a host entry in the HOSTS file pointing to the machine's shortname	Rule to monitor Microsoft ATA 1.8 Gateway - There is a host entry in the HOSTS file pointing to the machine's shortname	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.HostEntryInHOSTSFile	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	Message Analyzer is installed on the ATA Gateway	Rule to monitor Microsoft ATA 1.8 Gateway - Message Analyzer is installed on the ATA Gateway	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.MessageAnalyzerIsInstalledOnGateway	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	NetworkActivityTranslator Message Data 0 Block Size	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.NetworkActivityTranslatorMessageData0BlockSize	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkActivityTranslator Message Data 0 Block Size	300	0		False			True
	NetworkListener ETW Dropped Events/Sec	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.NetworkListenerETWDroppedEvents_Sec	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkListener ETW Dropped Events/Sec	300	0		False			True
	NetworkListener PEF Dropped Events/Sec	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.NetworkListenerPEFDroppedEvents_Sec	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkListener PEF Dropped Events/Sec	300	0		False			True
	NetworkListener PEF Parsed Messages/Sec	1.8	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.NetworkListenerPEFParsedMessages_Sec	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	PerformanceCollection	True	Microsoft ATA Gateway	NetworkListener PEF Parsed Messages/Sec	300	0		False			True
	There are other pending installations on your computer	Rule to monitor Microsoft ATA 1.8 Gateway - There are other pending installations on your computer	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.OtherPendingInstallations	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	PEF (Message Analyzer) was not installed correctly	Rule to monitor Microsoft ATA 1.8 Gateway - PEF (Message Analyzer) was not installed correctly	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.PEFWasNotInstalledCorrectly	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True
	PIDs was enabled for process names in the ATA Gateway	Rule to monitor Microsoft ATA 1.8 Gateway - PIDs was enabled for process names in the ATA Gateway	Microsoft.AdvancedThreatAnalytics.1_8.Gateway.PIDsWasEnabledForProcessNamesInGateway	Microsoft.AdvancedThreatAnalytics.1_8.Gateway	AvailabilityHealth	True			0	0		True	Error	Normal	True