Abnormal Behavior Suspicious Activity Alert Rule
|
0 
|
Advanced Threat Analytics 1.7 Center
|
|
|
Abnormal Behavior Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
Abnormal Protocol Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
Abnormal Sensitive Group Membership Change Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
Abnormal SMB Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.7 Center
|
|
|
Abnormal Vpn Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
Account Enumeration Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.7 Center
|
|
|
Account Enumeration Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA 1.7 - Center Database Data Drive Free Space Monitoring Alert Alert Rule
|
1 
|
Advanced Threat Analytics 1.7 Center
|
|
|
ATA 1.7 - Center Overloaded Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.7 Center
|
|
|
ATA 1.7 - Certificate Expiry Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.7 Center
|
|
|
ATA 1.7 - Database Disconnected Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.7 Center
|
|
|
ATA 1.7 - Directory Services Client Account Password Expiry Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.7 Center
|
|
|
ATA 1.7 - Domain Synchronizer Not Assigned Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.7 Center
|
|
|
ATA 1.7 - Gateway Capture Network Adapter Faulted Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.7 Center
|
|
|
ATA 1.7 - Gateway Capture Network Adapter Missing Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.7 Center
|
|
|
ATA 1.7 - Gateway Directory Services Client Connectivity Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.7 Center
|
|
|
ATA 1.7 - Gateway Disconnected Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.7 Center
|
|
|
ATA 1.7 - Gateway Low Memory Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.7 Center
|
|
|
ATA 1.7 - Gateway Not Receiving Traffic Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.7 Center
|
|
|
ATA 1.7 - Gateway Overloaded Event Activities Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.7 Center
|
|
|
ATA 1.7 - Gateway Overloaded Network Activities Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.7 Center
|
|
|
ATA 1.7 - Gateway Start Failure Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.7 Center
|
|
|
ATA 1.7 - Gateways Outdated Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.7 Center
|
|
|
ATA 1.7 - Mail Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.7 Center
|
|
|
ATA 1.7 - Syslog Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.7 Center
|
|
|
ATA 1.8 - Center Database Data Drive Free Space Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA 1.8 - Center Database Disconnected Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA 1.8 - Center External Ip Address Resolution Failure Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA 1.8 - Center Mail Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA 1.8 - Center Not Receiving Traffic Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA 1.8 - Center Overloaded Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA 1.8 - Center Syslog Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA 1.8 - Certificate Expiry Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA 1.8 - Gateway Capture Network Adapter Faulted Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA 1.8 - Gateway Capture Network Adapter Missing Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA 1.8 - Gateway Directory Services Client Account Password Expiry Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA 1.8 - Gateway Directory Services Client Connectivity Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA 1.8 - Gateway Disconnected Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA 1.8 - Gateway Domain Synchronizer Not Assigned Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA 1.8 - Gateway Low Memory Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA 1.8 - Gateway Overloaded Event Activities Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA 1.8 - Gateway Overloaded Network Activities Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA 1.8 - Gateway Radius Event Listener Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA 1.8 - Gateway Start Failure Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA 1.8 - Gateway Syslog Event Listener Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA 1.8 - Gateways Outdated Monitoring Alert Alert Rule
|
1
|
Advanced Threat Analytics 1.8 Center
|
|
|
ATA Gateway does not have enough memory
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway does not have enough memory |
|
ATA Gateway does not have enough memory
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
Rule to monitor Microsoft ATA 1.8 Gateway - ATA Gateway does not have enough memory |
|
ATA Gateway Failed to Authenticate Against Center
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway Failed to Authenticate Against Center |
|
ATA Gateway Failed to Authenticate Against Center
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
Rule to monitor Microsoft ATA 1.8 Gateway - ATA Gateway Failed to Authenticate Against Center |
|
ATA Gateway Failed to Authenticate Against the Domain Controller
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway Failed to Authenticate Against the Domain Controller |
|
ATA Gateway Failed to Authenticate Against the Domain Controller
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
Rule to monitor Microsoft ATA 1.8 Gateway - ATA Gateway Failed to Authenticate Against the Domain Controller |
|
ATA Gateway failed to establish connection to the ATA Center
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway failed to establish connection to the ATA Center |
|
ATA Gateway failed to establish connection to the ATA Center
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
Rule to monitor Microsoft ATA 1.8 Gateway - ATA Gateway failed to establish connection to the ATA Center |
|
ATA Gateway Failed to Parse SIEM Syslog Message
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway Failed to Parse SIEM Syslog Message |
|
ATA Gateway Failed to Parse SIEM Syslog Message
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
Rule to monitor Microsoft ATA 1.8 Gateway - ATA Gateway Failed to Parse SIEM Syslog Message |
|
ATA Gateway failed to query the domain controller using the LDAP protocol
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway failed to query the domain controller using the LDAP protocol |
|
ATA Gateway failed to query the domain controller using the LDAP protocol
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
Rule to monitor Microsoft ATA 1.8 Gateway - ATA Gateway failed to query the domain controller using the LDAP protocol |
|
ATA Gateway failed to synchronize the configuration from the ATA Center
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway failed to synchronize the configuration from the ATA Center |
|
ATA Gateway failed to synchronize the configuration from the ATA Center
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
Rule to monitor Microsoft ATA 1.8 Gateway - ATA Gateway failed to synchronize the configuration from the ATA Center |
|
ATA Gateway Failed to Validate Center Certificate Chain
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
Rule to monitor Microsoft ATA 1.7 Gateway - ATA Gateway Failed to Validate Center Certificate Chain |
|
ATA Gateway Failed to Validate Center Certificate Chain
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
Rule to monitor Microsoft ATA 1.8 Gateway - ATA Gateway Failed to Validate Center Certificate Chain |
|
Brute Force Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.7 Center
|
|
|
Brute Force Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
Computer Pre-Authentication Failed Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.7 Center
|
|
|
Computer Pre-Authentication Failed Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
Counters might be disabled in the registry
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
Rule to monitor Microsoft ATA 1.7 Gateway - Counters might be disabled in the registry |
|
Counters might be disabled in the registry
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
Rule to monitor Microsoft ATA 1.8 Gateway - Counters might be disabled in the registry |
|
Database AtSVC Block Size
|
1
|
Advanced Threat Analytics 1.7 Center
|
The number of Network Activities of a specific type queued to be written to the database |
|
Database AtSVC Block Size
|
1
|
Advanced Threat Analytics 1.8 Center
|
1.8 |
|
Database DirectoryServicesActivity Block Size
|
1
|
Advanced Threat Analytics 1.7 Center
|
The number of Network Activities of a specific type queued to be written to the database |
|
Database DirectoryServicesActivity Block Size
|
1
|
Advanced Threat Analytics 1.8 Center
|
1.8 |
|
Database DNS Block Size
|
1
|
Advanced Threat Analytics 1.7 Center
|
The number of Network Activities of a specific type queued to be written to the database |
|
Database DNS Block Size
|
1
|
Advanced Threat Analytics 1.8 Center
|
1.8 |
|
Database DRSR Block Size
|
1
|
Advanced Threat Analytics 1.7 Center
|
The number of Network Activities of a specific type queued to be written to the database |
|
Database DRSR Block Size
|
1
|
Advanced Threat Analytics 1.8 Center
|
1.8 |
|
Database KerberosAP Block Size
|
1
|
Advanced Threat Analytics 1.7 Center
|
The number of Network Activities of a specific type queued to be written to the database |
|
Database KerberosAP Block Size
|
1
|
Advanced Threat Analytics 1.8 Center
|
1.8 |
|
Database KerberosAS Block Size
|
1
|
Advanced Threat Analytics 1.7 Center
|
The number of Network Activities of a specific type queued to be written to the database |
|
Database KerberosAS Block Size
|
1
|
Advanced Threat Analytics 1.8 Center
|
1.8 |
|
Database KerberosTGS Block Size
|
1
|
Advanced Threat Analytics 1.7 Center
|
The number of Network Activities of a specific type queued to be written to the database |
|
Database KerberosTGS Block Size
|
1
|
Advanced Threat Analytics 1.8 Center
|
1.8 |
|
Database LDAP Block Size
|
1
|
Advanced Threat Analytics 1.7 Center
|
The number of Network Activities of a specific type queued to be written to the database |
|
Database LDAP Block Size
|
1
|
Advanced Threat Analytics 1.8 Center
|
1.8 |
|
Database LsaRPC Block Size
|
1
|
Advanced Threat Analytics 1.7 Center
|
The number of Network Activities of a specific type queued to be written to the database |
|
Database LsaRPC Block Size
|
1
|
Advanced Threat Analytics 1.8 Center
|
1.8 |
|
Database Netlogon Block Size
|
1
|
Advanced Threat Analytics 1.7 Center
|
The number of Network Activities of a specific type queued to be written to the database |
|
Database Netlogon Block Size
|
1
|
Advanced Threat Analytics 1.8 Center
|
1.8 |
|
Database NTLM Block Size
|
1
|
Advanced Threat Analytics 1.7 Center
|
The number of Network Activities of a specific type queued to be written to the database |
|
Database NTLM Block Size
|
1
|
Advanced Threat Analytics 1.8 Center
|
1.8 |
|
Database NTLMEvent Block Size
|
1
|
Advanced Threat Analytics 1.7 Center
|
The number of Network Activities of a specific type queued to be written to the database |
|
Database NTLMEvent Block Size
|
1
|
Advanced Threat Analytics 1.8 Center
|
1.8 |
|
Database ServiceControl Block Size
|
1
|
Advanced Threat Analytics 1.7 Center
|
The number of Network Activities of a specific type queued to be written to the database |
|
Database ServiceControl Block Size
|
1
|
Advanced Threat Analytics 1.8 Center
|
1.8 |
|
Database SMB Block Size
|
1
|
Advanced Threat Analytics 1.7 Center
|
The number of Network Activities of a specific type queued to be written to the database |
|
Database SMB Block Size
|
1
|
Advanced Threat Analytics 1.8 Center
|
1.8 |
|
Database SrvSVC Block Size
|
1
|
Advanced Threat Analytics 1.7 Center
|
The number of Network Activities of a specific type queued to be written to the database |
|
Database SrvSVC Block Size
|
1
|
Advanced Threat Analytics 1.8 Center
|
1.8 |
|
Database TaskScheduler Block Size
|
1
|
Advanced Threat Analytics 1.7 Center
|
The number of Network Activities of a specific type queued to be written to the database |
|
Database TaskScheduler Block Size
|
1
|
Advanced Threat Analytics 1.8 Center
|
1.8 |
|
Directory Services Replication Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.7 Center
|
|
|
Directory Services Replication Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
DNS Reconnaissance Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.7 Center
|
|
|
DNS Reconnaissance Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
Encryption Downgrade Suspicious Activity (Golden Ticket) Alert Rule
|
0
|
Advanced Threat Analytics 1.7 Center
|
|
|
Encryption Downgrade Suspicious Activity (Golden Ticket) Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
Encryption Downgrade Suspicious Activity (Overpass the Hash) Alert Rule
|
0
|
Advanced Threat Analytics 1.7 Center
|
|
|
Encryption Downgrade Suspicious Activity (Overpass the Hash) Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
Encryption Downgrade Suspicious Activity (Skeleton Key) Alert Rule
|
0
|
Advanced Threat Analytics 1.7 Center
|
|
|
Encryption Downgrade Suspicious Activity (Skeleton Key) Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
Encryption Downgrade Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.7 Center
|
|
|
Encryption Downgrade Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
EntityProfiler Network Activity Block Size
|
1
|
Advanced Threat Analytics 1.7 Center
|
The number of Network Activities (NAs) queued for profiling |
|
EntityProfiler Network Activity Block Size
|
1
|
Advanced Threat Analytics 1.8 Center
|
1.8 |
|
EntityReceiver Entity Batch Block Size
|
1
|
Advanced Threat Analytics 1.7 Center
|
The number of entity batches queued by the ATA Center |
|
EntityReceiver Entity Batch Block Size
|
1
|
Advanced Threat Analytics 1.8 Center
|
1.8 |
|
EntityResolver Activity Block Size
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
The amount of Network Activities (NAs) queued for resolution |
|
EntityResolver Activity Block Size
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
1.8 |
|
EntitySender Entity Batch Block Size
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
The amount of Network Activities (NAs) queued to be sent to the ATA Center |
|
EntitySender Entity Batch Block Size
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
1.8 |
|
EntitySender Entity Batch Send Time
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
The amount of time it took to send the last batch |
|
EntitySender Entity Batch Send Time
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
1.8 |
|
Enumerate Sessions Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.7 Center
|
|
|
Enumerate Sessions Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
Forged Pac Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.7 Center
|
|
|
Forged Pac Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
GatewayUpdaterResourceManager Commit Memory Max Size
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
The maximum amount of committed memory (in bytes) that the Lightweight Gateway process can consume |
|
GatewayUpdaterResourceManager Commit Memory Max Size
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
1.8 |
|
GatewayUpdaterResourceManager CPU Time Max %
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
The maximum amount of CPU time (in percentage) that the Lightweight Gateway process can consume |
|
GatewayUpdaterResourceManager CPU Time Max %
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
1.8 |
|
GatewayUpdaterResourceManager Working Set Limit Size
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
The Maximum amount of physical memory (in bytes) that the Lightweight Gateway process can consume |
|
GatewayUpdaterResourceManager Working Set Limit Size
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
1.8 |
|
Honeytoken Activity Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.7 Center
|
|
|
Honeytoken Activity Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
LDAP Simple Bind Cleartext Password Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.7 Center
|
|
|
LDAP Simple Bind Cleartext Password Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
Massive Object Deletion Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.7 Center
|
|
|
Massive Object Deletion Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
Message Analyzer is installed on the ATA Gateway
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
Rule to monitor Microsoft ATA 1.7 Gateway - Message Analyzer is installed on the ATA Gateway |
|
Message Analyzer is installed on the ATA Gateway
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
Rule to monitor Microsoft ATA 1.8 Gateway - Message Analyzer is installed on the ATA Gateway |
|
NetworkActivityProcessor Network Activity Block Size
|
1
|
Advanced Threat Analytics 1.7 Center
|
The number of Network Activities (NAs) queued for processing |
|
NetworkActivityProcessor Network Activity Block Size
|
1
|
Advanced Threat Analytics 1.8 Center
|
1.8 |
|
NetworkActivityTranslator Message Data 0 Block Size
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
The amount of traffic queued for translation to Network Activities (NAs) |
|
NetworkActivityTranslator Message Data 0 Block Size
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
1.8 |
|
NetworkActivityTranslator Message Data 1 Block Size
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
The amount of traffic queued for translation to Network Activities (NAs) |
|
NetworkActivityTranslator Message Data 2 Block Size
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
The amount of traffic queued for translation to Network Activities (NAs) |
|
NetworkListener ETW Dropped Events/Sec
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
The amount of traffic being dropped by the ATA Gateway every second |
|
NetworkListener ETW Dropped Events/Sec
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
1.8 |
|
NetworkListener PEF Dropped Events/Sec
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
The amount of traffic being dropped by the ATA Gateway every second |
|
NetworkListener PEF Dropped Events/Sec
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
1.8 |
|
NetworkListener PEF Parsed Messages/Sec
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
The amount of traffic being processed by the ATA Gateway every second |
|
NetworkListener PEF Parsed Messages/Sec
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
1.8 |
|
Pass The Hash Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.7 Center
|
|
|
Pass The Hash Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
Pass The Ticket Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.7 Center
|
|
|
Pass The Ticket Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
PEF (Message Analyzer) was not installed correctly
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
Rule to monitor Microsoft ATA 1.7 Gateway - PEF (Message Analyzer) was not installed correctly |
|
PEF (Message Analyzer) was not installed correctly
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
Rule to monitor Microsoft ATA 1.8 Gateway - PEF (Message Analyzer) was not installed correctly |
|
PIDs was enabled for process names in the ATA Gateway
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
Rule to monitor Microsoft ATA 1.7 Gateway - PIDs was enabled for process names in the ATA Gateway |
|
PIDs was enabled for process names in the ATA Gateway
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
Rule to monitor Microsoft ATA 1.8 Gateway - PIDs was enabled for process names in the ATA Gateway |
|
Remote Execution Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.7 Center
|
|
|
Remote Execution Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
Retrieve Data Protection Backup Key Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.7 Center
|
|
|
Retrieve Data Protection Backup Key Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.8 Center
|
|
|
SAMR Reconnaissance Suspicious Activity Alert Rule
|
0
|
Advanced Threat Analytics 1.7 Center
|
|
|
There are other pending installations on your computer
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
Rule to monitor Microsoft ATA 1.7 Gateway - There are other pending installations on your computer |
|
There are other pending installations on your computer
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
Rule to monitor Microsoft ATA 1.8 Gateway - There are other pending installations on your computer |
|
There is a host entry in the HOSTS file pointing to the machine's shortname
|
1
|
Advanced Threat Analytics 1.7 Gateway
|
Rule to monitor Microsoft ATA 1.7 Gateway - There is a host entry in the HOSTS file pointing to the machine's shortname |
|
There is a host entry in the HOSTS file pointing to the machine's shortname
|
1
|
Advanced Threat Analytics 1.8 Gateway
|
Rule to monitor Microsoft ATA 1.8 Gateway - There is a host entry in the HOSTS file pointing to the machine's shortname |