ATA – Microsoft Advanced Threat Analytics – Deployment Guide Part 1

As some of you may be aware Microsoft Advanced Threat Analytic’s has just been released so I took the time to go through the RTM version and below is a step by step guide to getting the platform in place.

Before we start there are some pre-requisites that should be observed and understood. There are technically three roles within ATA which are:

  • ATA Center – The brain behind ATA
  • ATA Console – The admin front end portal
  • ATA Gateway – The collector of information

It should be noted at this time it is only supported to install this on premise and NOT within Azure. This is simply because it currently has not been tested by Microsoft. The servers can be either domain or work group joined depending on the environment.

The main challenge is the networking elements for port mirroring so depending on your environment the following are the main considerations which are supported port mirroring options:

ATA Gateway Domain Controller Considerations
Virtual Virtual on same host The virtual switch needs to support port mirroring.
Moving one of the virtual machines to another host by itself may break the port mirroring.
Virtual Virtual on different hosts Make sure your virtual switch supports this scenario.
Virtual Physical Requires a dedicated network adapter otherwise ATA will see all of the traffic coming in and out of the host, even the traffic it sends to the ATA Center.
Physical Virtual Make sure your virtual switch supports this scenario – and port mirroring configuration on your physical switches based on the scenario:
If the virtual host is on the same physical switch, you will need to configure a switch level span.
If the virtual host is on a different switch, you will need to configure RSPAN or ERSPAN*.
Physical Physical on the same switch Physical switch must support SPAN/Port Mirroring.
Physical Physical on a different switch Requires physical switches to support RSPAN or ERSPAN*.

*ERSPAN is only supported when decapsulation is performed before the traffic is analyzed by ATA.

I will come back to the importance of port mirroring shortly.

For the ATA Center Sizing below is the guidance provided by Microsoft. Note the ATA Center includes both the Center and the Console roles of which cannot be split and this is local storage as the Database cannot be on another server.

Packets per second* CPU (cores**) Memory (GB) OS Storage (GB) Database storage per day (GB) Database storage per month (GB)
1,000 4 48 200 1.5 45
10,000 4 48 200 15 450
40,000 8 64 200 60 1,800
100,000 12 96 200 150 4,500
200,000 16 128 200 300 9,000

This server should also have a single NIC with two IP addresses, it is possible to configure the service with one IP address although this is not recommended.

The ATA Gateway has the following hardware. For this server it should be noted that two NIC’s are required and the second NIC should be attached to the same switch as the domain controllers that it is monitoring, following the guidance regarding port mirroring above.

Packets-per-second* CPU (cores**) Memory OS Storage (GB)
10,000 4 12 80
20,000 8 24 100
40,000 16 64 200

*Total daily average number of packets per-second from all domain controllers being monitored

**This includes physical cores, not hyper-threaded cores.

Once you have all of this you will also need to create a service account as a standard user as this will be used by the ATA center to gather information on AD users.

The final note is that both ATA servers cannot be out of time sync by more than 5 minutes of each other.

In part 2 I will go through the installation in more detail.

2 thoughts on “ATA – Microsoft Advanced Threat Analytics – Deployment Guide Part 1

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.