Edit

ATA Role Groups

  • Article

Applies to: Advanced Threat Analytics version 1.9

Role groups enable access management for ATA. Using role groups, you can segregate duties within your security team, and grant only the amount of access that users need to perform their jobs. This article explains access management and ATA role authorization, and helps you get up and running with role groups in ATA.

Note

Any local administrator on the ATA Center is automatically a Microsoft Advanced Threat Analytics Administrator.

Types of ATA Role Groups

ATA introduces three types of Role group: ATA Administrators, ATA Users, and ATA Viewers. The following table describes the type of access in ATA available per role. Depending on which role you assign, various screens and menu options in ATA are not available, as follows:

Activity Microsoft Advanced Threat Analytics Administrators Microsoft Advanced Threat Analytics Users Microsoft Advanced Threat Analytics Viewers
Login Available Available Available
Provide Input for Suspicious Activities Available Available Not available
Change status of Suspicious Activities Available Available Not available
Share/Export suspicious activity via email/get link Available Available Not available
Change status of Health Alerts Available Available Not available
Update ATA Configuration Available Not available Not available
Gateway – Add Available Not available Not available
Gateway – Delete Available Not available Not available
Monitored DC – Add Available Not available Not available
Monitored DC – Delete Available Not available Not available
View alerts and suspicious activities Available Available Available

When users try to access a page that is not available for their role group, they are redirected to the ATA unauthorized page.

Add \ Remove users - ATA Role Groups

ATA uses the local Windows groups as a basis for role groups. The role groups must be managed on the ATA Center server. To add or remove users, use the Local Users and Groups MMC (Lusrmgr.msc). On a domain joined machine, you can add domain accounts as well as local accounts.