Microsoft Advanced Threat Analytics

Details
Content
Dependencies
Version History

Manage suspicious activities, monitoring alerts and entities on Microsoft ATA.

Incident Types

Name	Description
Microsoft ATA Suspicious Activity

Integrations

Name	Description
Microsoft Advanced Threat Analytics	Use Microsoft Advanced Threat Analytics integration to manage suspicious activities, monitoring alerts and entities.

Classifiers

Name	Description
Microsoft Advanced Threat Analytics - Classification	Classifies Microsoft Advanced Threat Analytics suspicious activities
Microsoft Advanced Threat Analytics - Incoming Mapper	Maps Microsoft Advanced Threat Analytics suspicious activity fields.

Incident Fields

Name	Description
Suspicious Activity End Time
Suspicious Activity Severity
Suspicious Activity Status
Suspicious Activity Start Time
Suspicious Activity ID

Layouts

Name	Description
Microsoft ATA Suspicious Activity

Modeling Rules

Name	Description
Microsoft Advanced Threat Analytics

Incident Types

Name	Description
Microsoft ATA Suspicious Activity

Integrations

Name	Description
Microsoft Advanced Threat Analytics	Use Microsoft Advanced Threat Analytics integration to manage suspicious activities, monitoring alerts and entities.

Classifiers

Name	Description
Microsoft Advanced Threat Analytics - Classification	Classifies Microsoft Advanced Threat Analytics suspicious activities
Microsoft Advanced Threat Analytics - Incoming Mapper	Maps Microsoft Advanced Threat Analytics suspicious activity fields.

Incident Fields

Name	Description
Suspicious Activity End Time
Suspicious Activity Severity
Suspicious Activity Status
Suspicious Activity Start Time
Suspicious Activity ID

Layouts

Name	Description
Microsoft ATA Suspicious Activity

Required Content Packs (1)

Pack Name	Pack By
Base	By: Cortex XSOAR

Optional Content Packs (1)

Pack Name	Pack By
Common Types	By: Cortex XSOAR

All level dependencies (37)

Pack Name	Pack By
Cisco Umbrella Investigate	By: Cortex XSOAR
Sophos XG Firewall	By: Cortex XSOAR
Developer Tools	By: Cortex XSOAR
Google Maps	By: Cortex XSOAR
Cylance Protect	By: Cortex XSOAR
CrowdStrike Falcon Intelligence Sandbox	By: Cortex XSOAR
ThreatX	By: Cortex XSOAR
VirusTotal - Private API (Deprecated)	By: VirusTotal
Access Investigation	By: Cortex XSOAR
MITRE ATT&CK	By: Cortex XSOAR
Slack	By: Cortex XSOAR
Signal Sciences WAF	By: Cortex XSOAR
Cisco Secure Cloud Analytics (Stealthwatch Cloud)	By: Cortex XSOAR
Zscaler Internet Access	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
VulnDB	By: Cortex XSOAR
PAN-OS by Palo Alto Networks	By: Cortex XSOAR
Remote Access	By: Cortex XSOAR
Check Point Firewall	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
FortiGate	By: Cortex XSOAR
ARIAPacketIntelligence	By: ARIA Cybersecurity Solutions
Gmail	By: Cortex XSOAR
Akamai WAF	By: Cortex XSOAR
Active Directory Query	By: Cortex XSOAR
Rapid7 InsightVM	By: Cortex XSOAR
Cisco Firepower	By: Cortex XSOAR
F5 Silverline	By: Cortex XSOAR
Image OCR	By: Cortex XSOAR
Palo Alto Networks PAN-OS EDL Management (Deprecated)	By: Cortex XSOAR
Kenna	By: Cortex XSOAR
Phishing	By: Cortex XSOAR
GenericSQL	By: Cortex XSOAR
Cisco ASA	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
CVE Search	By: Cortex XSOAR
EWS	By: Cortex XSOAR

PUBLISHER

Cortex

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	November 9, 2020
Last Release	January 17, 2023

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.