Microsoft Advanced Threat Analytics

Details

ID	`Microsoft Advanced Threat Analytics`
Provider	Microsoft
Category	Forensics & Malware Analysis
From Version	5.0.0
Docker Image	`demisto/ntlm:1.0.0.107683`
Supported Modules	Agentix XSIAM

README

Manage suspicious activities, monitoring alerts and entities on Microsoft ATA.

This integration was integrated and tested with version 1.9.7478.57683 of Microsoft Advanced Threat Analytics.

Configure Microsoft Advanced Threat Analytics in Cortex

Parameter	Description	Required
url	ATA Center URL (e.g. https://atacenter.contoso.com)	True
credentials	Username	True
isFetch	Fetch incidents	False
incidentType	Incident type	False
max_fetch	Maximum number of incidents per fetch	False
activity_status	Fetch suspicious activity with status	False
activity_type	Fetch suspicious activity with type (leave empty to fetch all)	False
min_severity	Minimum severity of suspicious activity to fetch	True
first_fetch	First fetch time range (<number> <time unit>, e.g., 1 hour, 30 minutes)	False
insecure	Trust any certificate (not secure)	False
proxy	Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ms-ata-suspicious-activities-list

Retrieves suspicious activities.

Base Command

ms-ata-suspicious-activities-list

Input

Argument Name	Description	Required
id	Identifier of suspicious activity to retrieve (if provided, all other arguments will be ignored).	Optional
status	Retrieve suspicious activities with the specified status (comma-seperated values suuported).	Optional
severity	Retrieve suspicious activities with the specified severity (comma-seperated values suuported).	Optional
type	Retrieve suspicious activities of the specified type (comma-seperated values suuported).	Optional
limit	The maximum number of suspicious activities to retrieve.	Optional
start_time	Retrieve suspicious activities which occurred after the given time. Supported formats: ISO 8601 (e.g. 2020-07-28T10:00:00Z) and time period (e.g. 24 hours).	Optional
end_time	Retrieve suspicious activities which occurred before the given time. Supported formats: ISO 8601 (e.g. 2020-07-28T10:00:00Z) and time period (e.g. 24 hours).	Optional

Context Output

Path	Type	Description
MicrosoftATA.SuspiciousActivity.DescriptionDetailFormatKeys	String	List of detailed description of the suspicious acitivity format keys.
MicrosoftATA.SuspiciousActivity.DescriptionFormatKey	String	Suspicious activity format key description.
MicrosoftATA.SuspiciousActivity.DestinationComputerIds	String	List of identifiers of the destination computers.
MicrosoftATA.SuspiciousActivity.EndTime	Date	End time of the suspicious activity.
MicrosoftATA.SuspiciousActivity.ExclusionUniqueEntityId	String	Exclusion entity identifier of the suspicious activity.
MicrosoftATA.SuspiciousActivity.HasDetails	Boolean	Whether the suspicious activity has further details to retrieve.
MicrosoftATA.SuspiciousActivity.HasUnknownLdapResources	Boolean	Whether the suspicious activity has unknown LDAP resources.
MicrosoftATA.SuspiciousActivity.HasUnknownNtlmResources	Boolean	Whether the suspicious activity has unknown NTLM resources.
MicrosoftATA.SuspiciousActivity.HoneytokenAccountId	String	Account identifier of the Honeytoken suspicious activity.
MicrosoftATA.SuspiciousActivity.Id	String	Identifier of the suspicious activity.
MicrosoftATA.SuspiciousActivity.IsAdditionalDataAvailable	Boolean	Whether the suspicious activity has additional data available.
MicrosoftATA.SuspiciousActivity.NtlmDestinationComputerIds	String	List of identifiers of the NTLM destination computers.
MicrosoftATA.SuspiciousActivity.NtlmSourceComputerIds	String	List of identifiers of the NTLM source computers.
MicrosoftATA.SuspiciousActivity.ReasonKey	String	The suspicious activity reason key.
MicrosoftATA.SuspiciousActivity.RelatedActivityCount	Boolean	Count of related suspicious activities.
MicrosoftATA.SuspiciousActivity.RelatedUniqueEntityIds	String	Exclusion entity identifier of related suspicious activities.
MicrosoftATA.SuspiciousActivity.Severity	String	Severity of the suspicious activity.
MicrosoftATA.SuspiciousActivity.SourceComputerIds	String	List of identifiers of the source computers.
MicrosoftATA.SuspiciousActivity.StartTime	Date	Start time of the suspicious activity.
MicrosoftATA.SuspiciousActivity.Status	String	Status of the suspicious activity.
MicrosoftATA.SuspiciousActivity.StatusUpdateTime	Date	Time in which the suspicious activity status was updated in.
MicrosoftATA.SuspiciousActivity.SystemCreationTime	Date	Time in which the suspicious activity was created in.
MicrosoftATA.SuspiciousActivity.SystemUpdateTime	Date	Time in which the suspicious activity was updated in.
MicrosoftATA.SuspiciousActivity.TitleKey	String	The suspicious activity title key.
MicrosoftATA.SuspiciousActivity.Type	String	Type of the suspicious activity.
MicrosoftATA.SuspiciousActivity.WindowsEventId	Boolean	Identifier of the suspicious activity windows event.
MicrosoftATA.SuspiciousActivity.DetailsRecords.IsLogin	Boolean	Whether the suspicious activity indicates a login.
MicrosoftATA.SuspiciousActivity.DetailsRecords.IsSuccess	Boolean	Whether the suspicious activity was successful.
MicrosoftATA.SuspiciousActivity.DetailsRecords.IsTraffic	Boolean	Whether the suspicious activity indicates a traffic.
MicrosoftATA.SuspiciousActivity.DetailsRecords.ProtocolName	String	Protocol of the suspicious activity.
MicrosoftATA.SuspiciousActivity.DetailsRecords.ResourceIdentifier	String	Identifier of the suspicious activity source.
MicrosoftATA.SuspiciousActivity.DetailsRecords.SourceComputerId	String	Identifier of the suspicious activity source computer.

Command Example


#### Context Example

{
“MicrosoftATA”: {
“SuspiciousActivity”: {
“DescriptionDetailFormatKeys”: [
“HoneytokenActivitySuspiciousActivityDescriptionDetailNtlmUnknownResourcesSuccess”
],
“DescriptionFormatKey”: “HoneytokenActivitySuspiciousActivityDescription”,
“DestinationComputerIds”: [
“6b0e48f5-6c63-449c-8b6f-c749e18e28b3”
],
“EndTime”: “2020-07-28T08:51:09.7050476Z”,
“EvidenceKeys”: [],
“ExclusionUniqueEntityId”: null,
“HasDetails”: true,
“HasUnknownLdapResources”: false,
“HasUnknownNtlmResources”: true,
“HoneytokenAccountId”: “7a58c171-fa19-44f9-bf1e-81b544b318ad”,
“Id”: “5f1fe6b383eaed101ce19b58”,
“IsAdditionalDataAvailable”: false,
“KerberosLoginDestinationComputerIds”: [],
“KerberosLoginSourceComputerIds”: [],
“KerberosResourceAccessDestinationComputerIds”: [],
“KerberosResourceAccessResourceIdentifiers”: [],
“KerberosResourceAccessSourceComputerIds”: [],
“LdapDestinationComputerIds”: [],
“LdapResourceIdentifiers”: [],
“LdapSourceComputerIds”: [],
“NtlmDestinationComputerIds”: [
“6b0e48f5-6c63-449c-8b6f-c749e18e28b3”
],
“NtlmResourceIdentifiers”: [],
“NtlmSourceComputerIds”: [
“computer ec2-1.eu.compute-1.amazonaws.com”
],
“ReasonKey”: “HoneytokenActivitySuspiciousActivityReason”,
“RelatedActivityCount”: 3,
“RelatedUniqueEntityIds”: [
“7a58c171-fa19-44f9-bf1e-81b544b318ad”,
“computer ec2-3.eu.compute-1.amazonaws.com”
],
“Severity”: “Medium”,
“SourceComputerIds”: [
“computer ec2-1.eu.compute-1.amazonaws.com”
],
“SourceIpAddresses”: [],
“StartTime”: “2020-07-28T08:49:54.1366697Z”,
“Status”: “Open”,
“StatusUpdateTime”: “2020-08-08T09:01:09.3438227Z”,
“SystemCreationTime”: “2020-07-28T08:49:55.3139871Z”,
“SystemUpdateTime”: “2020-08-08T09:01:09.3438227Z”,
“TitleKey”: “HoneytokenActivitySuspiciousActivityTitle”,
“Type”: “HoneytokenActivitySuspiciousActivity”,
“WindowsEventId”: 2014
}
}
}


#### Human Readable Output

>### Microsoft Advanced Threat Analytics Suspicious Activity

>|Id|Type|Status|Severity|StartTime|EndTime|
>|---|---|---|---|---|---|
>| 5f1fe6b383eaed101ce19b58 | HoneytokenActivitySuspiciousActivity | Open | Medium | 2020-07-28T08:49:54.1366697Z | 2020-07-28T08:51:09.7050476Z |

### ms-ata-suspicious-activity-status-set

***
Sets suspicious activity status.

#### Base Command

`ms-ata-suspicious-activity-status-set`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| id | Identifier of suspicious activity to update status of. | Required |
| status | Status to update to | Required |

#### Context Output

There is no context output for this command.

#### Command Example

```!ms-ata-suspicious-activity-status-set id="5f1fe6b383eaed101ce19b58" status="Closed"```

#### Human Readable Output

>Suspicious activity 5f1fe6b383eaed101ce19b58 status was updated to Closed successfully.

### ms-ata-monitoring-alerts-list

***
Retrieves health alerts.

#### Base Command

`ms-ata-monitoring-alerts-list`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| status | Retrieve monitoring alerts with the specified status (comma-seperated values suuported). | Optional |
| severity | Retrieve monitoring alerts with the specified severity (comma-seperated values suuported). | Optional |
| type | Retrieve monitoring alerts of the specified type (comma-seperated values suuported). | Optional |
| limit | The maximum number of monitoring alerts to retrieve. | Optional |
| start_time | Retrieve monitoring alerts which occurred after the given time. Supported formats: ISO 8601 (e.g. 2020-07-28T10:00:00Z) and time period (e.g. 24 hours).<br/> | Optional |
| end_time | Retrieve monitoring alerts which occurred before the given time. Supported formats: ISO 8601 (e.g. 2020-07-28T10:00:00Z) and time period (e.g. 24 hours). | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| MicrosoftATA.MonitoringAlert.DescriptionFormatKey | String | Monitoring alert format key description. |
| MicrosoftATA.MonitoringAlert.DomainSynchronizerNotAssignedDomainDnsNames | String | Monitoring alert domain synchronizer not assigned domain DNS names. |
| MicrosoftATA.MonitoringAlert.EndTime | Date | End time of the monitoring alert. |
| MicrosoftATA.MonitoringAlert.Id | String | Identifier of the monitoring alert. |
| MicrosoftATA.MonitoringAlert.NotificationTime | Date | Notification time of the monitoring alert. |
| MicrosoftATA.MonitoringAlert.Severity | String | Severity of the monitoring alert. |
| MicrosoftATA.MonitoringAlert.StartTime | Date | Start time of the monitoring alert. |
| MicrosoftATA.MonitoringAlert.Status | String | Status of the monitoring alert. |
| MicrosoftATA.MonitoringAlert.StatusUpdateTime | Date | Status update time of the monitoring alert. |
| MicrosoftATA.MonitoringAlert.TitleKey | String | The monitoring alert title key. |
| MicrosoftATA.MonitoringAlert.Type | String | Type of the monitoring alert. |
| MicrosoftATA.MonitoringAlert.WindowsEventId | Boolean | Identifier of the monitoring alert windows event. |
| MicrosoftATA.MonitoringAlert.AccountDomainName | String | Monitoring alert account domain name. |
| MicrosoftATA.MonitoringAlert.AccountName | String | Monitoring alert account name. |
| MicrosoftATA.MonitoringAlert.IsPasswordExpired | Boolean | Whether the monitoring alert indicates that password has expired. |
| MicrosoftATA.MonitoringAlert.PasswordExpiryTime | Date | Password expiry time. |

#### Command Example

```!ms-ata-monitoring-alerts-list```

#### Context Example

{
“MicrosoftATA”: {
“MonitoringAlert”: [
{
“DescriptionDetailFormatKeys”: [],
“DescriptionFormatKey”: “GatewayDomainSynchronizerNotAssignedMonitoringAlertDescription”,
“DomainSynchronizerNotAssignedDomainDnsNames”: [
“demisto.local”
],
“EndTime”: “2020-07-28T11:17:28.6742502Z”,
“Id”: “5f159bbd83eaed101cd5c4e5”,
“NotificationTime”: “2020-07-20T13:27:25.8510125Z”,
“Severity”: “Low”,
“StartTime”: “2020-07-20T13:27:25.7800034Z”,
“Status”: “Closed”,
“StatusUpdateTime”: “2020-07-28T11:17:28.6742502Z”,
“TitleKey”: “GatewayDomainSynchronizerNotAssignedMonitoringAlertTitle”,
“Type”: “GatewayDomainSynchronizerNotAssignedMonitoringAlert”,
“WindowsEventId”: 1007
},
{
“AccountDomainName”: “demisto”,
“AccountName”: “Administrator”,
“DescriptionDetailFormatKeys”: [],
“DescriptionFormatKey”: “GatewayDirectoryServicesClientAccountPasswordExpiryMonitoringAlertDescriptionNearExpiry”,
“EndTime”: “2020-07-28T12:06:30.9408859Z”,
“Id”: “5f159e9283eaed101cd5c837”,
“IsPasswordExpired”: false,
“NotificationTime”: “2020-07-20T13:39:30.5978881Z”,
“PasswordExpiryTime”: “2020-08-17T13:01:15.1609716Z”,
“Severity”: “Medium”,
“StartTime”: “2020-07-20T13:39:30.5559003Z”,
“Status”: “Closed”,
“StatusUpdateTime”: “2020-07-28T12:06:30.9408859Z”,
“TitleKey”: “GatewayDirectoryServicesClientAccountPasswordExpiryMonitoringAlertTitleNearExpiry”,
“Type”: “GatewayDirectoryServicesClientAccountPasswordExpiryMonitoringAlert”,
“WindowsEventId”: 1006
}
]
}
}


#### Human Readable Output

>### Microsoft Advanced Threat Analytics Monitoring Alert

>|Id|Type|Status|Severity|StartTime|EndTime|
>|---|---|---|---|---|---|
>| 5f159bbd83eaed101cd5c4e5 | GatewayDomainSynchronizerNotAssignedMonitoringAlert | Closed | Low | 2020-07-20T13:27:25.7800034Z | 2020-07-28T11:17:28.6742502Z |
>| 5f159e9283eaed101cd5c837 | GatewayDirectoryServicesClientAccountPasswordExpiryMonitoringAlert | Closed | Medium | 2020-07-20T13:39:30.5559003Z | 2020-07-28T12:06:30.9408859Z |

### ms-ata-entity-get

***
Retrieves information of distinct entity, such as computers and users.

#### Base Command

`ms-ata-entity-get`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| id | Identifier of distinct entity to retrieve (Can be retrieved by running the command ms-ata-suspicious-activities-list from the output RelatedUniqueEntityIds). | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| MicrosoftATA.Entity.BadPasswordTime | Date | Time in which bad password was entered. |
| MicrosoftATA.Entity.CanonicalName | String | Entity canonical name. |
| MicrosoftATA.Entity.CreationTime | Date | Time in which the entity was created in. |
| MicrosoftATA.Entity.Description | String | Entity description. |
| MicrosoftATA.Entity.DistinguishedName | String | Entity distinguished name. |
| MicrosoftATA.Entity.DnsName | String | Entity DNS name. |
| MicrosoftATA.Entity.DomainController.IsGlobalCatalog | Boolean | Whether the entity is in the global catalog. |
| MicrosoftATA.Entity.DomainController.IsPrimary | Boolean | Whether the entity is primary. |
| MicrosoftATA.Entity.DomainController.IsReadOnly | Boolean | Whether the entity is read only. |
| MicrosoftATA.Entity.DomainId | String | Identifier of the entity domain. |
| MicrosoftATA.Entity.ExpiryTime | Date | Expiration time of the entity. |
| MicrosoftATA.Entity.Id | String | Identifer of the entity. |
| MicrosoftATA.Entity.IpAddress | String | Entity IP address. |
| MicrosoftATA.Entity.IsDelegationEnabled | Boolean | Whether the entity is delegation enabled. |
| MicrosoftATA.Entity.IsDeleted | Boolean | Whether the entity is deleted. |
| MicrosoftATA.Entity.IsDesEncryptionOnly | Boolean | Whether the entity is Data Encryption Standard only. |
| MicrosoftATA.Entity.IsDisabled | Boolean | Whether the entity is disabled. |
| MicrosoftATA.Entity.IsDomainController | Boolean | Whether the entity is domain controller. |
| MicrosoftATA.Entity.IsExpired | Boolean | Whether the entity is expired. |
| MicrosoftATA.Entity.IsHoneytoken | Boolean | Whether the entity is related to Honeytoken activity. |
| MicrosoftATA.Entity.IsLocked | Boolean | Whether the entity is locked. |
| MicrosoftATA.Entity.IsNew | Boolean | Whether the entity is new. |
| MicrosoftATA.Entity.IsNotDelegatable | Boolean | Whether the entity is non\-delegatable. |
| MicrosoftATA.Entity.IsPartial | Boolean | Whether the entity is partial. |
| MicrosoftATA.Entity.IsPasswordExpired | Boolean | Whether the entity password is expired. |
| MicrosoftATA.Entity.IsSensitive | Boolean | Whether the entity is sensitive. |
| MicrosoftATA.Entity.IsServer | Boolean | Whether the entity is a server. |
| MicrosoftATA.Entity.IsSmartcardRequired | Boolean | Whether a smart card is required for the entity. |
| MicrosoftATA.Entity.OperatingSystemDisplayName | String | The entity OS name, |
| MicrosoftATA.Entity.SamName | String | Entitiy Security Account Manager name. |
| MicrosoftATA.Entity.Sid | String | Entity security identifier. |
| MicrosoftATA.Entity.Spns | String | Entity Search Service Principal Names. |
| MicrosoftATA.Entity.SystemCreationTime | Date | System creation time of the entity. |
| MicrosoftATA.Entity.SystemDisplayName | String | System display name of the entity. |
| MicrosoftATA.Entity.Type | String | Type of the entity. |
| MicrosoftATA.Entity.UpnName | String | Entity User Principal Name. |
| MicrosoftATA.Entity.Profile.IsBehaviorChanged | Boolean | Whether the entity profile behavior changed. |
| MicrosoftATA.Entity.Profile.OpenSuspiciousActivityCount | Boolean | Number of entity profile suspicious activities. |
| MicrosoftATA.Entity.Profile.SuspiciousActivitySeverityToCountMapping.High | Number | Number of entity profile suspicious activities with High severity. |
| MicrosoftATA.Entity.Profile.SuspiciousActivitySeverityToCountMapping.Low | Number | Number of entity profile suspicious activities with Low severity. |
| MicrosoftATA.Entity.Profile.SuspiciousActivitySeverityToCountMapping.Medium | Number | Number of entity profile suspicious activities with Medium severity. |
| MicrosoftATA.Entity.Profile.Type | String | Type of the entity profile. |
| MicrosoftATA.Entity.Profile.UpdateTime | Date | Update time of the entity profile. |

#### Command Example

```!ms-ata-entity-get id="7a58c171-fa19-44f9-bf1e-81b544b318ad"```

#### Context Example

{
“MicrosoftATA”: {
“Entity”: {
“BadPasswordTime”: null,
“CanonicalName”: “demisto.local/Users/Test ATA”,
“ConstrainedDelegationSpns”: [],
“CreationTime”: “2020-07-21T13:58:11Z”,
“Department”: null,
“Description”: null,
“DistinguishedName”: “CN=Test ATA,CN=Users,DC=demisto,DC=local”,
“DomainId”: “3ae90e0d-eb20-4a4c-a922-0606ab7ae307”,
“ExpiryTime”: null,
“HasPhoto”: false,
“Id”: “7a58c171-fa19-44f9-bf1e-81b544b318ad”,
“IsDelegationEnabled”: false,
“IsDeleted”: false,
“IsDesEncryptionOnly”: false,
“IsDisabled”: false,
“IsExpired”: false,
“IsHoneytoken”: true,
“IsLocked”: false,
“IsNew”: true,
“IsNotDelegatable”: false,
“IsPartial”: false,
“IsPasswordExpired”: false,
“IsPasswordFarExpiry”: false,
“IsPasswordNeverExpires”: true,
“IsPasswordNotRequired”: false,
“IsPlaintextPasswordAllowed”: false,
“IsPreauthenticationNotRequired”: false,
“IsSensitive”: false,
“IsSmartcardRequired”: false,
“IsTaggedAsSensitive”: false,
“Mail”: null,
“MobileNumber”: null,
“Office”: null,
“PasswordExpiryTime”: null,
“PasswordUpdateTime”: “2020-07-21T13:58:11.4101455Z”,
“PhoneNumber”: null,
“Profile”: {
“AccessedResourceAccountIdToTimeMapping”: {},
“DateToPrivilegeEscalationPathsMapping”: {},
“DateToSourceComputerIdToProtocolToCertaintyMapping”: {
“2020-07-21T00:00:00Z”: {
“6b0e48f5-6c63-449c-8b6f-c749e18e28b3”: {
“NtlmEvent”: “High”
}
},
“2020-07-22T00:00:00Z”: {
“6b0e48f5-6c63-449c-8b6f-c749e18e28b3”: {
“NtlmEvent”: “High”
},
“computer ec2-1.eu.compute-1.amazonaws.com”: {
“NtlmEvent”: “High”
}
},
“2020-07-28T00:00:00Z”: {
“computer ec2-1.eu.compute-1.amazonaws.com”: {
“NtlmEvent”: “High”
}
}
},
“GeolocationIdToTimeMapping”: {},
“Id”: “7a58c171-fa19-44f9-bf1e-81b544b318ad”,
“IsBehaviorChanged”: true,
“LogonComputerIdToTimeMapping”: {},
“OpenSuspiciousActivityCount”: 0,
“SuspiciousActivitySeverityToCountMapping”: {
“High”: 0,
“Low”: 0,
“Medium”: 0
},
“Type”: “UserProfile”,
“UpdateTime”: “2020-07-28T09:00:13.8696377Z”
},
“SamName”: “testata”,
“SensitiveRootParentGroupIds”: [],
“SensitivityReasonFormatKeys”: [],
“Sid”: “S-1-5-21-1234499873-1172443441-1549941920-1115”,
“Spns”: [],
“SystemCreationTime”: “2020-07-21T14:00:07.5795659Z”,
“SystemDisplayName”: “Test ATA”,
“SystemSubDisplayName”: null,
“Title”: null,
“Type”: “User”,
“UpnName”: “testata@demisto.local”
}
}
}
```

Human Readable Output

Microsoft Advanced Threat Analytics Entity 7a58c171-fa19-44f9-bf1e-81b544b318ad

Id SystemDisplayName DistinguishedName UpnName Type CreationTime

7a58c171-fa19-44f9-bf1e-81b544b318ad Test ATA CN=Test ATA,CN=Users,DC=demisto,DC=local testata@demisto.local User 2020-07-21T13:58:11Z

Id	SystemDisplayName	DistinguishedName	UpnName	Type	CreationTime
7a58c171-fa19-44f9-bf1e-81b544b318ad	Test ATA	CN=Test ATA,CN=Users,DC=demisto,DC=local	testata@demisto.local	User	2020-07-21T13:58:11Z

Entity Profile

Type SuspiciousActivitySeverityToCountMapping UpdateTime IsBehaviorChanged

UserProfile Low: 0
Medium: 0
High: 0 2020-07-28T09:00:13.8696377Z true

Type	SuspiciousActivitySeverityToCountMapping	UpdateTime	IsBehaviorChanged
UserProfile	Low: 0 Medium: 0 High: 0	2020-07-28T09:00:13.8696377Z	true

Configuration parameters

url — ATA Center URL (e.g. https://atacenter.contoso.com) (required)
credentials — Username (required)
isFetch — Fetch incidents
incidentType — Incident type
max_fetch — Maximum number of incidents per fetch
activity_status — Fetch suspicious activity with status
activity_type — Fetch suspicious activity with type (leave empty to fetch all)
min_severity — Minimum severity of suspicious activity to fetch (required)
first_fetch — First fetch time range (<number> <time unit>, e.g., 1 hour, 30 minutes)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (4)

ms-ata-entity-get Deprecated
Retrieves information of an entity, such as a computer and user.
ms-ata-monitoring-alerts-list Deprecated
Retrieves health alerts.
ms-ata-suspicious-activities-list Deprecated
Retrieves suspicious activities.
ms-ata-suspicious-activity-status-set Deprecated
Sets the status of the suspicious activity.

Source

MicrosoftAdvancedThreatAnalytics.py MicrosoftAdvancedThreatAnalytics_test.py MicrosoftAdvancedThreatAnalytics.yml MicrosoftAdvancedThreatAnalytics_description.md command_examples.txt

Download History Raw

category: Forensics & Malware Analysis
provider: Microsoft
commonfields:
  id: Microsoft Advanced Threat Analytics
  version: -1
configuration:
- display: ATA Center URL (e.g. https://atacenter.contoso.com)
  name: url
  required: true
  type: 0
- display: Username
  name: credentials
  required: true
  type: 9
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
- defaultvalue: '10'
  display: Maximum number of incidents per fetch
  name: max_fetch
  type: 0
  required: false
- defaultvalue: Open
  display: Fetch suspicious activity with status
  name: activity_status
  options:
  - Open
  - Closed
  - Suppressed
  type: 16
  required: false
- additionalinfo: Comma-separated list of types of suspcious activities to fetch (e.g. HoneytokenActivitySuspiciousActivity)
  display: Fetch suspicious activity with type (leave empty to fetch all)
  name: activity_type
  type: 0
  required: false
- defaultvalue: Low
  display: Minimum severity of suspicious activity to fetch
  name: min_severity
  options:
  - Low
  - Medium
  - High
  required: true
  type: 15
- defaultvalue: 3 days
  display: First fetch time range (<number> <time unit>, e.g., 1 hour, 30 minutes)
  name: first_fetch
  type: 0
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: Deprecated. No available replacement.
display: Microsoft Advanced Threat Analytics (Deprecated)
name: Microsoft Advanced Threat Analytics
script:
  commands:
  - arguments:
    - description: Identifier of suspicious activity to retrieve (if provided, all other arguments are ignored).
      name: id
    - auto: PREDEFINED
      description: 'The specified status of the suspicious activities to retrieve (comma-separated values supported). Can be: "Open", "Closed", and "Suppressed".'
      name: status
      predefined:
      - Open
      - Closed
      - Suppressed
    - auto: PREDEFINED
      description: 'The specified severity of the suspicious activities to retrieve (comma-separated values supported). Can be: "Low", "High", and "Medium".'
      name: severity
      predefined:
      - Low
      - High
      - Medium
    - description: The specified type of the suspicious activities to retrieve (comma-separated values supported). For example, honeytoken.
      name: type
    - defaultValue: '50'
      description: The maximum number of suspicious activities to retrieve. Default is 50.
      name: limit
    - description: |
        Suspicious activities which occurred after the given time to retrieve. Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours).
      name: start_time
    - description: 'Suspicious activities which occurred before the given time to retrieve. Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours).'
      name: end_time
    description: Retrieves suspicious activities.
    name: ms-ata-suspicious-activities-list
    outputs:
    - contextPath: MicrosoftATA.SuspiciousActivity.DescriptionDetailFormatKeys
      description: The Description detail of the suspicious activity format keys.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.DescriptionFormatKey
      description: The description format key of the suspicious activity.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.DestinationComputerIds
      description: The identifiers of the destination computers.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.EndTime
      description: The end time of the suspicious activity.
      type: Date
    - contextPath: MicrosoftATA.SuspiciousActivity.ExclusionUniqueEntityId
      description: The exclusion entity identifier of the suspicious activity.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.HasDetails
      description: Whether the suspicious activity has further details to retrieve.
      type: Boolean
    - contextPath: MicrosoftATA.SuspiciousActivity.HasUnknownLdapResources
      description: Whether the suspicious activity has unknown LDAP resources.
      type: Boolean
    - contextPath: MicrosoftATA.SuspiciousActivity.HasUnknownNtlmResources
      description: Whether the suspicious activity has unknown NTLM resources.
      type: Boolean
    - contextPath: MicrosoftATA.SuspiciousActivity.HoneytokenAccountId
      description: Account identifier of the Honeytoken suspicious activity.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.Id
      description: Identifier of the suspicious activity.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.IsAdditionalDataAvailable
      description: Whether the suspicious activity has additional data available.
      type: Boolean
    - contextPath: MicrosoftATA.SuspiciousActivity.NtlmDestinationComputerIds
      description: The list of identifiers of the NTLM destination computers.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.NtlmSourceComputerIds
      description: The list of identifiers of the NTLM source computers.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.ReasonKey
      description: The reason key of the suspicious activity.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.RelatedActivityCount
      description: The activity count of related suspicious activities.
      type: Boolean
    - contextPath: MicrosoftATA.SuspiciousActivity.RelatedUniqueEntityIds
      description: The exclusion entity identifier of related suspicious activities.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.Severity
      description: The severity of the suspicious activity.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.SourceComputerIds
      description: The kist of identifiers of the source computers.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.StartTime
      description: The start time of the suspicious activity.
      type: Date
    - contextPath: MicrosoftATA.SuspiciousActivity.Status
      description: The status of the suspicious activity.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.StatusUpdateTime
      description: The time in which the suspicious activity status was updated.
      type: Date
    - contextPath: MicrosoftATA.SuspiciousActivity.SystemCreationTime
      description: The time in which the suspicious activity was created.
      type: Date
    - contextPath: MicrosoftATA.SuspiciousActivity.SystemUpdateTime
      description: The time in which the suspicious activity was updated.
      type: Date
    - contextPath: MicrosoftATA.SuspiciousActivity.TitleKey
      description: The title key of the suspicious activity.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.Type
      description: The type of the suspicious activity.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.WindowsEventId
      description: The identifier of the suspicious activity windows event.
      type: Boolean
    - contextPath: MicrosoftATA.SuspiciousActivity.DetailsRecords.IsLogin
      description: Whether the suspicious activity indicates a login.
      type: Boolean
    - contextPath: MicrosoftATA.SuspiciousActivity.DetailsRecords.IsSuccess
      description: Whether the suspicious activity was successful.
      type: Boolean
    - contextPath: MicrosoftATA.SuspiciousActivity.DetailsRecords.IsTraffic
      description: Whether the suspicious activity indicates a traffic.
      type: Boolean
    - contextPath: MicrosoftATA.SuspiciousActivity.DetailsRecords.ProtocolName
      description: The protocol of the suspicious activity.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.DetailsRecords.ResourceIdentifier
      description: The identifier of the suspicious activity source.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.DetailsRecords.SourceComputerId
      description: The identifier of the suspicious activity source computer.
      type: String
    deprecated: true
  - arguments:
    - description: The Identifier of suspicious activity for which to update the status.
      name: id
      required: true
    - auto: PREDEFINED
      description: 'The status for which to update. Can be: "Open", "Closed", "Suppressed", or "Delete".'
      name: status
      predefined:
      - Open
      - Closed
      - Suppressed
      - Delete
      required: true
    description: Sets the status of the suspicious activity.
    name: ms-ata-suspicious-activity-status-set
    deprecated: true
  - arguments:
    - auto: PREDEFINED
      description: 'Monitoring alerts with a specified status to retrieve (comma-separated values supported). Can be: "Open", "Closed", and "Suppressed".'
      name: status
      predefined:
      - Open
      - Closed
      - Suppressed
    - auto: PREDEFINED
      description: 'Monitoring alerts with a specified severity to retrieve (comma-separated values supported). Can be: "Low", "High", and "Medium".'
      name: severity
      predefined:
      - Low
      - High
      - Medium
    - description: Monitoring alerts of the specified type to retrieve (comma-separated values supported).
      name: type
    - defaultValue: '50'
      description: The maximum number of monitoring alerts to retrieve. Default is 50.
      name: limit
    - description: |
        Monitoring alerts which occurred after the given time to retrieve. Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours).
      name: start_time
    - description: 'Monitoring alerts which occurred before the given time to retrieve. Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours).'
      name: end_time
    description: Retrieves health alerts.
    name: ms-ata-monitoring-alerts-list
    outputs:
    - contextPath: MicrosoftATA.MonitoringAlert.DescriptionFormatKey
      description: The format key description of the monitoring alert.
      type: String
    - contextPath: MicrosoftATA.MonitoringAlert.DomainSynchronizerNotAssignedDomainDnsNames
      description: The domain synchronizer not assigned domain DNS name of the monitoring alert.
      type: String
    - contextPath: MicrosoftATA.MonitoringAlert.EndTime
      description: The end time of the monitoring alert.
      type: Date
    - contextPath: MicrosoftATA.MonitoringAlert.Id
      description: The identifier of the monitoring alert.
      type: String
    - contextPath: MicrosoftATA.MonitoringAlert.NotificationTime
      description: The notification time of the monitoring alert.
      type: Date
    - contextPath: MicrosoftATA.MonitoringAlert.Severity
      description: The severity of the monitoring alert.
      type: String
    - contextPath: MicrosoftATA.MonitoringAlert.StartTime
      description: The start time of the monitoring alert.
      type: Date
    - contextPath: MicrosoftATA.MonitoringAlert.Status
      description: The status of the monitoring alert.
      type: String
    - contextPath: MicrosoftATA.MonitoringAlert.StatusUpdateTime
      description: The status update time of the monitoring alert.
      type: Date
    - contextPath: MicrosoftATA.MonitoringAlert.TitleKey
      description: The title key of the monitoring alert.
      type: String
    - contextPath: MicrosoftATA.MonitoringAlert.Type
      description: The type of the monitoring alert.
      type: String
    - contextPath: MicrosoftATA.MonitoringAlert.WindowsEventId
      description: The identifier of the monitoring alert windows event.
      type: Boolean
    - contextPath: MicrosoftATA.MonitoringAlert.AccountDomainName
      description: The account domain name of the monitoring alert.
      type: String
    - contextPath: MicrosoftATA.MonitoringAlert.AccountName
      description: The account name of the monitoring alert.
      type: String
    - contextPath: MicrosoftATA.MonitoringAlert.IsPasswordExpired
      description: Whether the password of the monitoring alert has expired.
      type: Boolean
    - contextPath: MicrosoftATA.MonitoringAlert.PasswordExpiryTime
      description: The password expiry time of the monitoring alert.
      type: Date
    deprecated: true
  - arguments:
    - description: The identifier of an entity to retrieve. Can be retrieved by running the ms-ata-suspicious-activities-list command (from the RelatedUniqueEntityIds output).
      name: id
      required: true
    description: Retrieves information of an entity, such as a computer and user.
    name: ms-ata-entity-get
    outputs:
    - contextPath: MicrosoftATA.Entity.BadPasswordTime
      description: The time that the bad password was entered.
      type: Date
    - contextPath: MicrosoftATA.Entity.CanonicalName
      description: The canonical name of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.CreationTime
      description: The time that entity was created.
      type: Date
    - contextPath: MicrosoftATA.Entity.Description
      description: The description of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.DistinguishedName
      description: The distinguished name of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.DnsName
      description: The DNS name of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.DomainController.IsGlobalCatalog
      description: Whether the entity is in the global catalog.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.DomainController.IsPrimary
      description: Whether the entity is primary.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.DomainController.IsReadOnly
      description: Whether the entity is read only.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.DomainId
      description: Identifier of the entity domain.
      type: String
    - contextPath: MicrosoftATA.Entity.ExpiryTime
      description: Expiration time of the entity.
      type: Date
    - contextPath: MicrosoftATA.Entity.Id
      description: Identifer of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.IpAddress
      description: The IP address of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.IsDelegationEnabled
      description: Whether the entity is delegation enabled.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsDeleted
      description: Whether the entity is deleted.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsDesEncryptionOnly
      description: Whether the entity is Data Encryption Standard only.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsDisabled
      description: Whether the entity is disabled.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsDomainController
      description: Whether the entity is domain controller.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsExpired
      description: Whether the entity has expired.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsHoneytoken
      description: Whether the entity is related to Honeytoken activity.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsLocked
      description: Whether the entity is locked.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsNew
      description: Whether the entity is new.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsNotDelegatable
      description: Whether the entity can be delegated.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsPartial
      description: Whether the entity is partial.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsPasswordExpired
      description: Whether the entity password has expired.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsSensitive
      description: Whether the entity is sensitive.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsServer
      description: Whether the entity is a server.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsSmartcardRequired
      description: Whether a smart card is required for the entity.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.OperatingSystemDisplayName
      description: The OS name of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.SamName
      description: The name of the Security Account Manager of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.Sid
      description: The security identifier of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.Spns
      description: The Search Service Principal Names of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.SystemCreationTime
      description: The system creation time of the entity.
      type: Date
    - contextPath: MicrosoftATA.Entity.SystemDisplayName
      description: The system display name of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.Type
      description: The type of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.UpnName
      description: The User Principal Name of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.Profile.IsBehaviorChanged
      description: Whether the entity profile behavior has changed.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.Profile.OpenSuspiciousActivityCount
      description: The number of entity profile suspicious activities.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.Profile.SuspiciousActivitySeverityToCountMapping.High
      description: The number of entity profile suspicious activities with high severity.
      type: Number
    - contextPath: MicrosoftATA.Entity.Profile.SuspiciousActivitySeverityToCountMapping.Low
      description: The number of entity profile suspicious activities with low severity.
      type: Number
    - contextPath: MicrosoftATA.Entity.Profile.SuspiciousActivitySeverityToCountMapping.Medium
      description: The number of entity profile suspicious activities with medium severity.
      type: Number
    - contextPath: MicrosoftATA.Entity.Profile.Type
      description: The type of the entity profile.
      type: String
    - contextPath: MicrosoftATA.Entity.Profile.UpdateTime
      description: The update time of the entity profile.
      type: Date
    deprecated: true
  dockerimage: demisto/ntlm:1.0.0.107683
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 5.0.0
defaultclassifier: Microsoft Advanced Threat Analytics
defaultmapperin: Microsoft Advanced Threat Analytics-mapper
tests:
- No tests (deprecated)
deprecated: true

Microsoft Advanced Threat Analytics Deprecated