You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: ATADocs/ata-health-center.md
-4Lines changed: 0 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,10 +3,6 @@
3
3
4
4
title: Monitor Advanced Threat Analytics System Health and Events
5
5
description: Use the ATA Health Center to check how the ATA service is working and be alerted to potential problems and view system events in the Event viewer.
Copy file name to clipboardExpand all lines: ATADocs/ata-privacy-compliance.md
+2-6Lines changed: 2 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,10 +3,6 @@
3
3
4
4
title: Advanced Threat Analytics personal data policy
5
5
description: Provides links to information about how to delete private information and personal data from ATA.
6
-
keywords:
7
-
author: batamig
8
-
ms.author: bagol
9
-
manager: raynew
10
6
ms.date: 01/10/2023
11
7
ms.topic: conceptual
12
8
ms.service: advanced-threat-analytics
@@ -34,7 +30,7 @@ ms.suite: ems
34
30
35
31
All data in ATA that relates to entities is derived from Active Directory (AD) and replicated to ATA from there. When searching for personal data, the first place you should consider searching is AD.
36
32
37
-
From the ATA Center, use the search bar to view the identifiable personal data that is stored in the database. Users can search for a specific user or device. Selecting the entity will open the user or device profile page. The profile provides you with the comprehensive details about the entity, it's history, and related network activity derived from AD.
33
+
From the ATA Center, use the search bar to view the identifiable personal data that is stored in the database. Users can search for a specific user or device. Selecting the entity opens the user or device profile page. The profile provides you with the comprehensive details about the entity, its history, and related network activity derived from AD.
38
34
39
35
## Updating personal data
40
36
@@ -62,7 +58,7 @@ Running this completely removes the entity with the UPN [email protected] from
62
58
63
59
### Delete entity activity data
64
60
65
-
This action permanently deletes an entity's activities data from the ATA database. All entities will are unchanged but the activities and security alerts related to them for the specified timeframe are deleted.
61
+
This action permanently deletes an entity's activities data from the ATA database. All entities are unchanged but the activities and security alerts related to them for the specified timeframe are deleted.
66
62
67
63
To run this command, provide the command name `deleteOldData`, and the number of days of data you want to keep in the database.
If you are using physical servers, you should plan capacity. You can get help from the sizing tool to allocate space for ATA:
50
+
If you're using physical servers, you should plan capacity. You can get help from the sizing tool to allocate space for ATA:
55
51
56
52
[ATA sizing tool](ata-capacity-planning.md) - The sizing tool automates the collection of the amount of traffic ATA needs. It automatically provides supportability and resource recommendations for both the ATA Center and ATA Lightweight Gateways.
57
53
58
54
[ATA capacity planning](ata-capacity-planning.md)
59
55
60
56
## Deploy ATA
61
57
62
-
These resources will help you download and install the ATA Center, connect to Active Directory, download the ATA Gateway package, set up event collection, and optionally integrate with your VPN and set up honeytoken accounts and exclusions.
58
+
These resources help you download and install the ATA Center, connect to Active Directory, download the ATA Gateway package, set up event collection, and optionally integrate with your VPN and set up honeytoken accounts and exclusions.
[ATA POC playbook](https://aka.ms/ataplaybook) - Guide to all the steps necessary to do a successful POC deployment of ATA.
67
63
68
64
## ATA settings
69
65
70
-
The basic necessary settings in ATA are configured as part of the installation wizard. However, there are a number of other settings that you can configure to fine-tune ATA that makes detections more accurate for your environment, such as SIEM integration and audit settings.
66
+
The basic necessary settings in ATA are configured as part of the installation wizard. However, there are many other settings that you can configure to fine-tune ATA that makes detections more accurate for your environment, such as SIEM integration and audit settings.
71
67
72
68
[Audit settings](https://github.com/microsoft/Azure-Advanced-Threat-Protection/tree/master/Auditing) – Audit your domain controller health before and after an ATA deployment.
73
69
74
70
[ATA general documentation](index.yml)
75
71
76
72
## Work with ATA
77
73
78
-
After ATA is up and running, you can view suspicious activities that are detected in the Attack timeline. This is the default landing page you are taken to when you log in to the ATA Console. By default, all open suspicious activities are shown on the attack time line. You can also see the severity assigned to each activity. Investigate each suspicious activity by drilling down into the entities (computers, devices, users) to open their profile pages that provide more information. These resources will help you work with ATA's suspicious activities:
74
+
After ATA is up and running, you can view suspicious activities that are detected in the Attack timeline. This is the default landing page you're taken to when you sign in to the ATA Console. By default, all open suspicious activities are shown on the attack time line. You can also see the severity assigned to each activity. Investigate each suspicious activity by drilling down into the entities (computers, devices, users) to open their profile pages that provide more information. These resources help you work with ATA's suspicious activities:
79
75
80
76
[ATA suspicious activity playbook](/samples/browse/?redirectedfrom=TechNet-Gallery) - This article walks you through credential theft attack techniques using readily available research tools on the internet. At each point of the attack, you can see how ATA helps you gain visibility into these threats.
0 commit comments