Masterclass: Implementing and Managing Microsoft Advanced Threat Analytics

Infrastructure architects, security professionals, systems engineers, network administrators, IT professionals, security consultants and other people responsible for implementing network and perimeter security.

• Module 1: Threat landscape
• Module 2: ATA Architecture
• Module 3: Prerequisites
• Module 4: Installation
• Module 5: Detection module
• Module 6: Analytics module
• Module 7: Management
• Module 8: Troubleshooting
• Module 9: Further steps

Module 1: Threat landscape

• Risks for cloud and on-premise infrastructure
• Modern threats
• Incident response flaws

Module 2: ATA Architecture

• ATA Center
• ATA Gateway
• ATA Console
• Multi-segment networks

Module 3: Prerequisites

• Active Directory requirements
• Networking requirements
• Database requirements
• Capacity planning
• Port and protocols

Module 4: Installation

• Port monitoring
• Event collection
• Mobility support
• Integration to SIEM/Syslog
• Virtualization issues

Module 5: Detection module

• Incident responding
• Short-term lease subnets
• Honeytokens

Module 6: Analytics module

• Suspicious Activities Time Line
• Filtering Suspicious Activities
• Self-learning

Module 7: Management

• ATA Console
• ATA Configuration
• Alerts
• Health Center
• Database management
• Telemetry

Module 8: Troubleshooting

• Backup and Restore
• Logs
• Performance counters
• Database

Module 9: Further steps

• Advanced monitoring techniques
• Incident response plans

An ideal candidate for this course should have attended Masterclass: Hacking and Securing Windows Infrastructure. You should alternatively have good knowledge on Windows authentication mechanisms and protocols. You should have good understanding of PTH and PTT attacks. Experience in Active Directory Domain Services is highly recommended.