category: Forensics & Malware Analysis
provider: Microsoft
commonfields:
  id: Microsoft Advanced Threat Analytics
  version: -1
configuration:
- display: ATA Center URL (e.g. https://atacenter.contoso.com)
  name: url
  required: true
  type: 0
- display: Username
  name: credentials
  required: true
  type: 9
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
- defaultvalue: '10'
  display: Maximum number of incidents per fetch
  name: max_fetch
  type: 0
  required: false
- defaultvalue: Open
  display: Fetch suspicious activity with status
  name: activity_status
  options:
  - Open
  - Closed
  - Suppressed
  type: 16
  required: false
- additionalinfo: Comma-separated list of types of suspcious activities to fetch (e.g. HoneytokenActivitySuspiciousActivity)
  display: Fetch suspicious activity with type (leave empty to fetch all)
  name: activity_type
  type: 0
  required: false
- defaultvalue: Low
  display: Minimum severity of suspicious activity to fetch
  name: min_severity
  options:
  - Low
  - Medium
  - High
  required: true
  type: 15
- defaultvalue: 3 days
  display: First fetch time range (<number> <time unit>, e.g., 1 hour, 30 minutes)
  name: first_fetch
  type: 0
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: Deprecated. No available replacement.
display: Microsoft Advanced Threat Analytics (Deprecated)
name: Microsoft Advanced Threat Analytics
script:
  commands:
  - arguments:
    - description: Identifier of suspicious activity to retrieve (if provided, all other arguments are ignored).
      name: id
    - auto: PREDEFINED
      description: 'The specified status of the suspicious activities to retrieve (comma-separated values supported). Can be: "Open", "Closed", and "Suppressed".'
      name: status
      predefined:
      - Open
      - Closed
      - Suppressed
    - auto: PREDEFINED
      description: 'The specified severity of the suspicious activities to retrieve (comma-separated values supported). Can be: "Low", "High", and "Medium".'
      name: severity
      predefined:
      - Low
      - High
      - Medium
    - description: The specified type of the suspicious activities to retrieve (comma-separated values supported). For example, honeytoken.
      name: type
    - defaultValue: '50'
      description: The maximum number of suspicious activities to retrieve. Default is 50.
      name: limit
    - description: |
        Suspicious activities which occurred after the given time to retrieve. Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours).
      name: start_time
    - description: 'Suspicious activities which occurred before the given time to retrieve. Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours).'
      name: end_time
    description: Retrieves suspicious activities.
    name: ms-ata-suspicious-activities-list
    outputs:
    - contextPath: MicrosoftATA.SuspiciousActivity.DescriptionDetailFormatKeys
      description: The Description detail of the suspicious activity format keys.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.DescriptionFormatKey
      description: The description format key of the suspicious activity.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.DestinationComputerIds
      description: The identifiers of the destination computers.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.EndTime
      description: The end time of the suspicious activity.
      type: Date
    - contextPath: MicrosoftATA.SuspiciousActivity.ExclusionUniqueEntityId
      description: The exclusion entity identifier of the suspicious activity.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.HasDetails
      description: Whether the suspicious activity has further details to retrieve.
      type: Boolean
    - contextPath: MicrosoftATA.SuspiciousActivity.HasUnknownLdapResources
      description: Whether the suspicious activity has unknown LDAP resources.
      type: Boolean
    - contextPath: MicrosoftATA.SuspiciousActivity.HasUnknownNtlmResources
      description: Whether the suspicious activity has unknown NTLM resources.
      type: Boolean
    - contextPath: MicrosoftATA.SuspiciousActivity.HoneytokenAccountId
      description: Account identifier of the Honeytoken suspicious activity.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.Id
      description: Identifier of the suspicious activity.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.IsAdditionalDataAvailable
      description: Whether the suspicious activity has additional data available.
      type: Boolean
    - contextPath: MicrosoftATA.SuspiciousActivity.NtlmDestinationComputerIds
      description: The list of identifiers of the NTLM destination computers.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.NtlmSourceComputerIds
      description: The list of identifiers of the NTLM source computers.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.ReasonKey
      description: The reason key of the suspicious activity.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.RelatedActivityCount
      description: The activity count of related suspicious activities.
      type: Boolean
    - contextPath: MicrosoftATA.SuspiciousActivity.RelatedUniqueEntityIds
      description: The exclusion entity identifier of related suspicious activities.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.Severity
      description: The severity of the suspicious activity.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.SourceComputerIds
      description: The kist of identifiers of the source computers.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.StartTime
      description: The start time of the suspicious activity.
      type: Date
    - contextPath: MicrosoftATA.SuspiciousActivity.Status
      description: The status of the suspicious activity.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.StatusUpdateTime
      description: The time in which the suspicious activity status was updated.
      type: Date
    - contextPath: MicrosoftATA.SuspiciousActivity.SystemCreationTime
      description: The time in which the suspicious activity was created.
      type: Date
    - contextPath: MicrosoftATA.SuspiciousActivity.SystemUpdateTime
      description: The time in which the suspicious activity was updated.
      type: Date
    - contextPath: MicrosoftATA.SuspiciousActivity.TitleKey
      description: The title key of the suspicious activity.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.Type
      description: The type of the suspicious activity.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.WindowsEventId
      description: The identifier of the suspicious activity windows event.
      type: Boolean
    - contextPath: MicrosoftATA.SuspiciousActivity.DetailsRecords.IsLogin
      description: Whether the suspicious activity indicates a login.
      type: Boolean
    - contextPath: MicrosoftATA.SuspiciousActivity.DetailsRecords.IsSuccess
      description: Whether the suspicious activity was successful.
      type: Boolean
    - contextPath: MicrosoftATA.SuspiciousActivity.DetailsRecords.IsTraffic
      description: Whether the suspicious activity indicates a traffic.
      type: Boolean
    - contextPath: MicrosoftATA.SuspiciousActivity.DetailsRecords.ProtocolName
      description: The protocol of the suspicious activity.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.DetailsRecords.ResourceIdentifier
      description: The identifier of the suspicious activity source.
      type: String
    - contextPath: MicrosoftATA.SuspiciousActivity.DetailsRecords.SourceComputerId
      description: The identifier of the suspicious activity source computer.
      type: String
    deprecated: true
  - arguments:
    - description: The Identifier of suspicious activity for which to update the status.
      name: id
      required: true
    - auto: PREDEFINED
      description: 'The status for which to update. Can be: "Open", "Closed", "Suppressed", or "Delete".'
      name: status
      predefined:
      - Open
      - Closed
      - Suppressed
      - Delete
      required: true
    description: Sets the status of the suspicious activity.
    name: ms-ata-suspicious-activity-status-set
    deprecated: true
  - arguments:
    - auto: PREDEFINED
      description: 'Monitoring alerts with a specified status to retrieve (comma-separated values supported). Can be: "Open", "Closed", and "Suppressed".'
      name: status
      predefined:
      - Open
      - Closed
      - Suppressed
    - auto: PREDEFINED
      description: 'Monitoring alerts with a specified severity to retrieve (comma-separated values supported). Can be: "Low", "High", and "Medium".'
      name: severity
      predefined:
      - Low
      - High
      - Medium
    - description: Monitoring alerts of the specified type to retrieve (comma-separated values supported).
      name: type
    - defaultValue: '50'
      description: The maximum number of monitoring alerts to retrieve. Default is 50.
      name: limit
    - description: |
        Monitoring alerts which occurred after the given time to retrieve. Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours).
      name: start_time
    - description: 'Monitoring alerts which occurred before the given time to retrieve. Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours).'
      name: end_time
    description: Retrieves health alerts.
    name: ms-ata-monitoring-alerts-list
    outputs:
    - contextPath: MicrosoftATA.MonitoringAlert.DescriptionFormatKey
      description: The format key description of the monitoring alert.
      type: String
    - contextPath: MicrosoftATA.MonitoringAlert.DomainSynchronizerNotAssignedDomainDnsNames
      description: The domain synchronizer not assigned domain DNS name of the monitoring alert.
      type: String
    - contextPath: MicrosoftATA.MonitoringAlert.EndTime
      description: The end time of the monitoring alert.
      type: Date
    - contextPath: MicrosoftATA.MonitoringAlert.Id
      description: The identifier of the monitoring alert.
      type: String
    - contextPath: MicrosoftATA.MonitoringAlert.NotificationTime
      description: The notification time of the monitoring alert.
      type: Date
    - contextPath: MicrosoftATA.MonitoringAlert.Severity
      description: The severity of the monitoring alert.
      type: String
    - contextPath: MicrosoftATA.MonitoringAlert.StartTime
      description: The start time of the monitoring alert.
      type: Date
    - contextPath: MicrosoftATA.MonitoringAlert.Status
      description: The status of the monitoring alert.
      type: String
    - contextPath: MicrosoftATA.MonitoringAlert.StatusUpdateTime
      description: The status update time of the monitoring alert.
      type: Date
    - contextPath: MicrosoftATA.MonitoringAlert.TitleKey
      description: The title key of the monitoring alert.
      type: String
    - contextPath: MicrosoftATA.MonitoringAlert.Type
      description: The type of the monitoring alert.
      type: String
    - contextPath: MicrosoftATA.MonitoringAlert.WindowsEventId
      description: The identifier of the monitoring alert windows event.
      type: Boolean
    - contextPath: MicrosoftATA.MonitoringAlert.AccountDomainName
      description: The account domain name of the monitoring alert.
      type: String
    - contextPath: MicrosoftATA.MonitoringAlert.AccountName
      description: The account name of the monitoring alert.
      type: String
    - contextPath: MicrosoftATA.MonitoringAlert.IsPasswordExpired
      description: Whether the password of the monitoring alert has expired.
      type: Boolean
    - contextPath: MicrosoftATA.MonitoringAlert.PasswordExpiryTime
      description: The password expiry time of the monitoring alert.
      type: Date
    deprecated: true
  - arguments:
    - description: The identifier of an entity to retrieve. Can be retrieved by running the ms-ata-suspicious-activities-list command (from the RelatedUniqueEntityIds output).
      name: id
      required: true
    description: Retrieves information of an entity, such as a computer and user.
    name: ms-ata-entity-get
    outputs:
    - contextPath: MicrosoftATA.Entity.BadPasswordTime
      description: The time that the bad password was entered.
      type: Date
    - contextPath: MicrosoftATA.Entity.CanonicalName
      description: The canonical name of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.CreationTime
      description: The time that entity was created.
      type: Date
    - contextPath: MicrosoftATA.Entity.Description
      description: The description of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.DistinguishedName
      description: The distinguished name of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.DnsName
      description: The DNS name of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.DomainController.IsGlobalCatalog
      description: Whether the entity is in the global catalog.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.DomainController.IsPrimary
      description: Whether the entity is primary.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.DomainController.IsReadOnly
      description: Whether the entity is read only.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.DomainId
      description: Identifier of the entity domain.
      type: String
    - contextPath: MicrosoftATA.Entity.ExpiryTime
      description: Expiration time of the entity.
      type: Date
    - contextPath: MicrosoftATA.Entity.Id
      description: Identifer of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.IpAddress
      description: The IP address of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.IsDelegationEnabled
      description: Whether the entity is delegation enabled.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsDeleted
      description: Whether the entity is deleted.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsDesEncryptionOnly
      description: Whether the entity is Data Encryption Standard only.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsDisabled
      description: Whether the entity is disabled.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsDomainController
      description: Whether the entity is domain controller.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsExpired
      description: Whether the entity has expired.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsHoneytoken
      description: Whether the entity is related to Honeytoken activity.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsLocked
      description: Whether the entity is locked.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsNew
      description: Whether the entity is new.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsNotDelegatable
      description: Whether the entity can be delegated.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsPartial
      description: Whether the entity is partial.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsPasswordExpired
      description: Whether the entity password has expired.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsSensitive
      description: Whether the entity is sensitive.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsServer
      description: Whether the entity is a server.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.IsSmartcardRequired
      description: Whether a smart card is required for the entity.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.OperatingSystemDisplayName
      description: The OS name of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.SamName
      description: The name of the Security Account Manager of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.Sid
      description: The security identifier of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.Spns
      description: The Search Service Principal Names of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.SystemCreationTime
      description: The system creation time of the entity.
      type: Date
    - contextPath: MicrosoftATA.Entity.SystemDisplayName
      description: The system display name of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.Type
      description: The type of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.UpnName
      description: The User Principal Name of the entity.
      type: String
    - contextPath: MicrosoftATA.Entity.Profile.IsBehaviorChanged
      description: Whether the entity profile behavior has changed.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.Profile.OpenSuspiciousActivityCount
      description: The number of entity profile suspicious activities.
      type: Boolean
    - contextPath: MicrosoftATA.Entity.Profile.SuspiciousActivitySeverityToCountMapping.High
      description: The number of entity profile suspicious activities with high severity.
      type: Number
    - contextPath: MicrosoftATA.Entity.Profile.SuspiciousActivitySeverityToCountMapping.Low
      description: The number of entity profile suspicious activities with low severity.
      type: Number
    - contextPath: MicrosoftATA.Entity.Profile.SuspiciousActivitySeverityToCountMapping.Medium
      description: The number of entity profile suspicious activities with medium severity.
      type: Number
    - contextPath: MicrosoftATA.Entity.Profile.Type
      description: The type of the entity profile.
      type: String
    - contextPath: MicrosoftATA.Entity.Profile.UpdateTime
      description: The update time of the entity profile.
      type: Date
    deprecated: true
  dockerimage: demisto/ntlm:1.0.0.107683
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 5.0.0
defaultclassifier: Microsoft Advanced Threat Analytics
defaultmapperin: Microsoft Advanced Threat Analytics-mapper
tests:
- No tests (deprecated)
deprecated: true