Threat Investigation Overview

Note:

This feature is available in a separate license.

Threat investigations use server metadata to quickly identify endpoints which are possible candidates for further analysis.

The following table describes the tabs on the Threat Investigation screen.

Tab

Description

Assessment

Use an assessment to perform the following:

  • Evaluate the prevalence of a threat, and how long the threat has been in the network. The assessment goes through all historical data.

  • Determine the existence of a threat using simple criteria. Assessments support only a limited set of criteria.

An assessment supports the following criteria types:

Root Cause Analysis

If an assessment returns a match, administrators may generate a root cause analysis to:

  • List all related objects to the specified criteria

  • Identify if any of the related objects are noteworthy

  • Review the sequence of events leading to the execution of the matched object.

Generating a root cause analysis may take some time to complete. Use the Root Cause Analysis tab to monitor the progress of the task.

When the task completes, click the number in the Results column to view analysis results.