-
Notifications
You must be signed in to change notification settings - Fork 105
/
ata-technical-faq.yml
222 lines (175 loc) · 12.6 KB
/
ata-technical-faq.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
### YamlMime:FAQ
metadata:
# required metadata
title: Advanced Threat Analytics frequently asked questions
description: Provides a list of frequently asked questions about ATA and the associated answers
keywords:
author: batamig
ms.author: bagol
manager: raynew
ms.date: 03/07/2019
ms.topic: conceptual
ms.service: advanced-threat-analytics
ms.assetid: a7d378ec-68ed-4a7b-a0db-f5e439c3e852
# optional metadata
#ROBOTS:
#audience:
#ms.devlang:
ms.reviewer: bennyl
ms.suite: ems
#ms.tgt_pltfrm:
#ms.custom:
title: ATA frequently asked questions
summary: |
[!INCLUDE [Banner for top of topics](includes/banner.md)]
This article provides a list of frequently asked questions about ATA and provides insight and answers.
sections:
- name: Ignored
questions:
- question: |
Where can I get a license for Advanced Threat Analytics (ATA)?
answer: |
If you have an active Enterprise Agreement, you can download the software from the Microsoft Volume Licensing Center (VLSC).
If you acquired a license for Enterprise Mobility + Security (EMS) directly via the Microsoft 365 portal or through the Cloud Solution Partner (CSP) licensing model and you do not have access to ATA through the Microsoft Volume Licensing Center (VLSC), contact Microsoft Customer Support to obtain the process to activate Advanced Threat Analytics (ATA).
- question: |
What should I do if the ATA Gateway won't start?
answer: |
Look at the most recent error in the current error log (Where ATA is installed under the "Logs" folder).
- question: |
How can I test ATA?
answer: |
You can simulate suspicious activities which is an end to end test by doing one of the following:
1. DNS reconnaissance by using Nslookup.exe
1. Remote execution by using psexec.exe
This needs to run remotely against the domain controller being monitored and not from the ATA Gateway.
- question: |
Which ATA build corresponds to each version?
answer: |
For version upgrade information, see [ATA upgrade path](upgrade-path.md).
- question: |
What version should I use to upgrade my current ATA deployment to the latest version?
answer: |
For the ATA version upgrade matrix, see [ATA upgrade path](upgrade-path.md).
- question: |
How does the ATA Center update its latest signatures?
answer: |
The ATA detection mechanism is enhanced when a new version is installed on the ATA Center. You can upgrade the Center either by using Microsoft Update (MU) or by manually downloading the new version from Download Center or Volume License Site.
- question: |
How do I verify Windows Event Forwarding?
answer: |
You can place the following code into a file and then execute it from a command prompt in the directory: **\Program Files\Microsoft Advanced Threat Analytics\Center\MongoDB\bin** as follows:
mongo.exe ATA filename
```
db.getCollectionNames().forEach(function(collection) {
if (collection.substring(0,10)=="NtlmEvent_") {
if (db[collection].count() > 0) {
print ("Found "+db[collection].count()+" NTLM events")
}
}
});
```
- question: |
Does ATA work with encrypted traffic?
answer: |
ATA relies on analyzing multiple network protocols, as well as events collected from the SIEM or via Windows Event Forwarding. Detections based on network protocols with encrypted traffic (for example, LDAPS and IPSEC) will not be analyzed.
- question: |
Does ATA work with Kerberos Armoring?
answer: |
Enabling Kerberos Armoring, also known as Flexible Authentication Secure Tunneling (FAST), is supported by ATA, with the exception of over-pass the hash detection which will not work.
- question: |
How many ATA Gateways do I need?
answer: |
The number of ATA Gateways depend on your network layout, volume of packets and volume of events captured by ATA. To determine the exact number, see [ATA Lightweight Gateway Sizing](ata-capacity-planning.md#ata-lightweight-gateway-sizing).
- question: |
How much storage do I need for ATA?
answer: |
For every one full day with an average of 1000 packets/sec you need 0.3 GB of storage. For more information about ATA Center sizing see, [ATA Capacity Planning](ata-capacity-planning.md).
- question: |
Why are certain accounts considered sensitive?
answer: |
This happens when an account is a member of certain groups which we designate as sensitive (for example: "Domain Admins").
To understand why an account is sensitive you can review its group membership to understand which sensitive groups it belongs to (the group that it belongs to can also be sensitive due to another group, so the same process should be performed until you locate the highest level sensitive group).
In addition, you can manually tag a user, group or computer as sensitive. For more information, see [Tag sensitive accounts](tag-sensitive-accounts.md).
- question: |
How do I monitor a virtual domain controller using ATA?
answer: |
Most virtual domain controllers can be covered by the ATA Lightweight Gateway, to determine whether the ATA Lightweight Gateway is appropriate for your environment, see [ATA Capacity Planning](ata-capacity-planning.md).
If a virtual domain controller can't be covered by the ATA Lightweight Gateway, you can have either a virtual or physical ATA Gateway as described in [Configure port mirroring](configure-port-mirroring.md).
The easiest way is to have a virtual ATA Gateway on every host where a virtual domain controller exists. If your virtual domain controllers move between hosts, you need to perform one of the following steps:
- When the virtual domain controller moves to another host, preconfigure the ATA Gateway in that host to receive the traffic from the recently moved virtual domain controller.
- Make sure that you affiliate the virtual ATA Gateway with the virtual domain controller so that if it is moved, the ATA Gateway moves with it.
- There are some virtual switches that can send traffic between hosts.
- question: |
How do I back up ATA?
answer: |
Refer to [ATA disaster recovery](disaster-recovery.md)
- question: |
What can ATA detect?
answer: |
ATA detects known malicious attacks and techniques, security issues, and risks.
For the full list of ATA detections, see [What detections does ATA perform?](ata-threats.md).
- question: |
What kind of storage do I need for ATA?
answer: |
We recommend fast storage (7200-RPM disks are not recommended) with low latency disk access (less than 10 ms). The RAID configuration should support heavy write loads (RAID-5/6 and their derivatives are not recommended).
- question: |
How many NICs does the ATA Gateway require?
answer: |
The ATA Gateway needs a minimum of two network adapters:<br>1. A NIC to connect to the internal network and the ATA Center<br>2. A NIC that is used to capture the domain controller network traffic via port mirroring.<br>* This does not apply to the ATA Lightweight Gateway, which natively uses all of the network adapters that the domain controller uses.
- question: |
What kind of integration does ATA have with SIEMs?
answer: |
ATA has a bi-directional integration with SIEMs as follows:
1. ATA can be configured to send a Syslog alert, to any SIEM server using the CEF format, when a suspicious activity is detected.
1. ATA can be configured to receive Syslog messages for Windows events from [these SIEMs](install-ata-step6.md).
- question: |
Can ATA monitor domain controllers virtualized on your IaaS solution?
answer: |
Yes, you can use the ATA Lightweight Gateway to monitor domain controllers that are in any IaaS solution.
- question: |
Is this an on-premises or in-cloud offering?
answer: |
Microsoft Advanced Threat Analytics is an on-premises product.
- question: |
Is this going to be a part of Microsoft Entra ID or on-premises Active Directory?
answer: |
This solution is currently a standalone offering—it is not a part of Microsoft Entra ID or on-premises Active Directory.
- question: |
Do you have to write your own rules and create a threshold/baseline?
answer: |
With Microsoft Advanced Threat Analytics, there is no need to create rules, thresholds, or baselines and then fine-tune. ATA analyzes the behaviors among users, devices, and resources—as well as their relationship to one another—and can detect suspicious activity and known attacks fast. Three weeks after deployment, ATA starts to detect behavioral suspicious activities. On the other hand, ATA will start detecting known malicious attacks and security issues immediately after deployment.
- question: |
If you are already breached, can Microsoft Advanced Threat Analytics identify abnormal behavior?
answer: |
Yes, even when ATA is installed after you have been breached, ATA can still detect suspicious activities of the hacker. ATA is not only looking at the user's behavior but also against the other users in the organization security map. During the initial analysis time, if the attacker's behavior is abnormal, then it is identified as an "outlier" and ATA keeps reporting on the abnormal behavior. Additionally ATA can detect the suspicious activity if the hacker attempts to steal another users credentials, such as Pass-the-Ticket, or attempts to perform a remote execution on one of the domain controllers.
- question: |
Does this only leverage traffic from Active Directory?
answer: |
In addition to analyzing Active Directory traffic using deep packet inspection technology, ATA can also collect relevant events from your Security Information and Event Management (SIEM) and create entity profiles based on information from Active Directory Domain Services. ATA can also collect events from the event logs if the organization configures Windows Event Log forwarding.
- question: |
What is port mirroring?
answer: |
Also known as SPAN (Switched Port Analyzer), port mirroring is a method of monitoring network traffic. With port mirroring enabled, the switch sends a copy of all network packets seen on one port (or an entire VLAN) to another port, where the packet can be analyzed.
- question: |
Does ATA monitor only domain-joined devices?
answer: |
No. ATA monitors all devices in the network performing authentication and authorization requests against Active Directory, including non-Windows and mobile devices.
- question: |
Does ATA monitor computer accounts as well as user accounts?
answer: |
Yes. Since computer accounts (as well as any other entities) can be used to perform malicious activities, ATA monitors all computer accounts behavior and all other entities in the environment.
- question: |
Can ATA support multi-domain and multi-forest?
answer: |
Microsoft Advanced Threat Analytics supports multi-domain environments within the same forest boundary. Multiple forests require an ATA deployment for each forest.
- question: |
Can you see the overall health of the deployment?
answer: |
Yes, you can view the overall health of the deployment as well as specific issues related to configuration, connectivity etc., and you are alerted as they occur.
additionalContent: |
## See Also
- [ATA prerequisites](ata-prerequisites.md)
- [ATA capacity planning](ata-capacity-planning.md)
- [Configure event collection](configure-event-collection.md)
- [Configuring Windows event forwarding](configure-event-collection.md)
- [Check out the ATA forum!](https://social.technet.microsoft.com/Forums/security/home?forum=mata)