Search for an identified file

Procedure

1. In the Trend Vision One console, access the Server & Workload Protection instance managing the infected endpoint.
2. Go to Events & Reports → Events → Anti-Malware Events → Identified Files.
3. To use Advanced Search, click Search this page and select Open Advanced Search.
   The Advanced Search appears under the Period and Computers filters.

   
4. Select the list column to search.
   Some of the following columns are hidden by default. Click Columns to manage the information you want to display.

   • Infected File(s): Search by file name
   • Malware: Search by malware name
   • Computer: Search by endpoint name
   • File SHA-1: Search by SHA-1 hash value
   • Container ID: Search by Docker container name
   • Container Image Name: Search by Docker container image name
   • Container Name: Search by Docker container name
5. Select an operator.
   • Contains: The entry in the selected column contains the search string.
   • Does Not Contain: The entry in the selected column does not contain the search string.
   • Equals: The entry in the selected column exactly matches the search string.
   • Does Not Equal: The entry in the selected column does not exactly match the search string.
   • In: The entry in the selected column exactly matches one of the comma-separated search string entries.
   • Not In: The entry in the selected column does not exactly match any of the comma-separated search string entries.
6. Specify a search string.

   Note Search strings are not case sensitive.

7. To add additional search criteria, click the add icon (+).
8. Click the search icon () to apply the search filters.