Microsoft Advanced Threat Analytics

Microsoft has evolved from a dominant PC software vendor into a broad technology provider with a major cloud focus, entering cloud computing in 2008 with Azure and expanding into a full stack of services that includes identity. Despite Microsoft’s long-term cloud strategy, most enterprises are expected to remain hybrid for the foreseeable future due to technical constraints, regulatory requirements, and legacy application burdens. This hybrid reality aligns with Microsoft’s enterprise identity leadership via Active Directory and explains why Microsoft Advanced Threat Analytics (ATA)—an on-premises product—is positioned within the cloud-delivered Enterprise Mobility + Security suite, alongside both cloud-first and hybrid-oriented tools.

ATA originates from Microsoft’s 2014 acquisition of Aorato, whose “Organizational Security Graph” methodology collects network traffic and identity signals non-intrusively and applies behavior analysis and machine learning to detect suspicious activities, security issues, and cyber-attacks. ATA monitors authentication and authorization activity to observe assets communicating with Active Directory, including remote and mobile devices. It detects known attack techniques (e.g., Pass-the-Hash, Pass-the-Ticket, Golden Ticket), identifies weaknesses (weak protocols, vulnerabilities, broken trust), and surfaces unknown threats via behavioral anomalies such as anomalous logins and lateral movement.

Deployment centers on an ATA Center for storage, correlation, and management, plus gateways using port mirroring or lightweight gateways on domain controllers. ATA integrates bidirectionally with SIEM tools and can forward alerts, though it lacks alert filtering by criticality. The console emphasizes an Attack Timeline and entity profiles, prioritizing ease of deployment, low tuning overhead, and reduced false positives. ATA is positioned as a lean Real-Time Security Intelligence solution that strengthens identity-centric defenses but is not a standalone replacement for a full SIEM-based SOC.

• Microsoft is headquartered in Redmond, Washington, USA, and was founded in 1975.
• Microsoft entered the cloud computing market in 2008 with the Azure platform.
• Azure is a global leader in cloud infrastructure and is second only to Amazon AWS.
• In 2014, Microsoft acquired Aorato, an Israel-based startup specializing in hybrid cloud security solutions.
• Microsoft Advanced Threat Analytics was officially launched in August 2015.
• The most recent update mentioned was released in June 2016.
• A typical ATA deployment includes an ATA Center and multiple ATA Gateways on standalone servers.
• ATA can be deployed out of band using port mirroring or via lightweight gateways directly on domain controllers.
• ATA supports SIEM integration with IBM QRadar, HP ArcSight, RSA Security Analytics, and Splunk.
• In its standard configuration, ATA sends anonymized telemetry about suspicious activities to Microsoft, and this can be disabled.

• “For many reasons, including technical challenges, regulatory compliance, and massive burdens of legacy applications, most companies have to opt for hybrid deployments for the present time, combining on-premises and cloud infrastructures.”
• “Aorato’s behavior detection methodology, aptly named Organizational Security Graph, provides non-intrusive collection of network traffic, event logs and other data sources in an enterprise network and then, using behavior analysis and machine learning algorithms, detects suspicious activities, security issues and cyber-attacks.”
• “The solution can be deployed as an out of band solution by using port mirroring, thus requiring no changes to an existing infrastructure.”
• “Since the product analyzes all authentication and authorization events, it’s able to monitor all assets communicating with the corporate Active Directory regardless of their location, including mobile devices beyond the corporate perimeter.”
• “As typical for Real-Time Security Intelligence solutions, there is no need to define any rules or adapt the product to organizational changes.”
• “Thus, it is not simply blindly looking for anomalies, but for meaningful signs of known attack techniques.”
• “In a sense, Microsoft ATA combines and extends the advantages of both traditional signature-based security tools and new behavior analytics solutions.”
• “The key element of the console is the Attack Timeline, which shows a chronological list of suspicious activities, with key information about the entities and assets involved, event severity, as well as the details of the attack.”
• “Unfortunately, there are no additional settings available – the product will generate alerts for all activities regardless of their source or criticality.”
• “It should not be deployed as a standalone solution, but integrated into an existing multi-layer security infrastructure.”