Licensing Advanced Threat Analytics

Advanced Threat Analytics (ATA), which became available in Aug. 2015, is a server-based product that automatically analyzes Active Directory (AD) activity to learn about normal behaviors and activity patterns in order to detect anomalies. (See “Advanced Threat Analytics Detects Anomalous Activity“.) The ATA license model is exclusively client-based, and licenses can be acquired stand-alone or through several license suites. While suite customers are the most likely users of the technology, unless they have purchased Per-User licenses across their entire organization, they will likely have to buy additional stand-alone ATA licenses in order to use the product.

Servers running the ATA infrastructure require no ATA-specific licenses, but all users or devices that access an AD installation protected by ATA must be covered by an ATA Client Management License (CML).

Server-Side Licensing

ATA requires at least one ATA Gateway server to monitor traffic and an ATA Center server to perform the analysis and reporting. There is no ATA server license, but the ATA Gateway(s) and the ATA Center server software runs on Windows Server 2012 R2 and those servers must be appropriately licensed for the server OS.