The solution works well when used with other Microsoft solutions.

It's rather easy to define your rules.

I like the fact that it looks for some of those very, very obscure techniques and attacks like golden tickets. Those are kind of very, very difficult attacks to spot. Not all of the teams that I worked with in the past had the ability to do that. With Microsoft ATA I was able to have visibility over those kinds of techniques and attacks. 

One of the most valuable features is the ability to report on questionable activity.