Domain synchronizer process "all entities from a specific Active Directory domain proactively"

[Bryan Bishop]

Hello,

The MS docs for the ATP Sensor (https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-architecture) mentions the "Domain synchronizer process".   I understand one of the functions of this process is to identify ADDS servers that do not have the ATP Sensor installed. The other function this performs is the synchronizing of entities.  

I'm trying to understand what "all entities" is referencing in the following statement: 

"The domain synchronizer process is responsible for synchronizing all entities from a specific Active Directory domain proactively (similar to the mechanism used by the domain controllers themselves for replication)."  Is this process replicate any ADDS object attributes to the ATP instance?  Or, is the purpose of this role only to look for infrastructure changes within the domain/forest, such as domain controllers being added?

Thanks

[#2]

@Bryan Bishop ,

It's actually both.

WE use it to create DC's inventory, and also sync entities like Users, Machines, Groups, Domains, Sites, forests , trusts, policies.

For each entity there is a set of attributes (which are interesting to detection) that we are syncing.

Eli

[#3]

@Eli Ofek 

Thanks for the response.   Where can I find reference to which properties of each object/entities are synced?

Thanks!

[#4]

@Bryan Bishop 

You can find partial info here:

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/monitored-activities

I don't think there is an official list maintained in the docs, as it's very dynamic, and might change on a weekly basis.

For now the rule of thumb is there we may sync anything from AD about Users, Machines, Groups, Domains, Sites, Forests, Policies, Trusts, which is not a "Secret" like a password or a hash (which are also not interesting for detection).

Viewing the profile page of an entity you can also see some of the data we sync, although data displayed is not all the data synced.

[#5]

@Eli Ofek Thanks again for the update and the link.  I believe that has the details I need.   Thank you