Download Data

Downloading Forensic Data

Download the .zip file containing forensic data from the following locations:

• The administrative console’s Case List screen

• The notification that TMSP sent through email

• TMSP sends the notification if you enabled the "Threat Sample Ready" notification. For details, see Configuring Event Notifications.

After downloading the .zip file, send it to Trend Micro for analysis.

To download the .zip file (event notification enabled):

1. Click the hyperlink in the email notification.

2. Save the file to your preferred location.

To download the .zip file (event notifications disabled):

1. In the administrative console, click Customers in the main menu.

2. Click the hyperlink under the Account column. The Case List screen appears.

3. Locate the case. In the Case List section, information about the case displays in the following columns:

   Column names and the information that display in each column when the .zip file becomes available

   Column Name	Information
   Case ID	Blank The case ID is initially blank. When you submit the .zip file to Trend Micro, a Trend Micro Threat Management Advisor will issue a case ID.
   Status	Any of the following status messages: New Case Received: You will see this status if no action has been performed on the case Administrator Notified About New Case: You will see this status only if you enabled notifications and if the notification was sent.
   Received	The date and time the .zip file was uploaded to TMSP
   Updated	N/A This column indicates the date and time you manually updated the case. Since you have not done an update, the data is N/A.
   Mitigation Server	The Threat Mitigator server that uploaded the .zip file
   Pattern ID	N/A The Pattern ID will only have a value if you upload a custom pattern or specify smart protection patterns.
   Endpoint	The endpoint from which the .zip file was created
   Download	A link to the .zip file containing forensic data

4. Under Download, click the .zip file. The file starts to download. When the download is complete, information in the Status column changes to Threat Sample Downloaded.

After downloading the .zip file:

1. Send the file to Trend Micro.

2. When you receive a case ID from Trend Micro, update the case ID.

1. In the administrative console, click Customers in the main menu.

2. Click the hyperlink under the Account column. The Case List screen appears.

3. Click the hyperlink under the Case ID column.

4. In the Edit Case screen that appears, type the case ID.

5. Click Apply. The Updated column refreshes, indicating the date and time you updated the case.

See also:

• Performing Threat Mitigation Tasks

• Managing Pattern Files Issued by Trend Micro