You can view correlation data for suspicious objects from the Threat Intelligence location.
Note
Note
You can use additional filters to filter the results displayed in the specified Threat Intelligence screens to make selection of the desired correlation data easier. See the Deep Discovery Director Administrator's Guide for more information.

Procedure

  1. Log on to the Deep Discovery Director console.
  2. Go to the appropriate location:
    • Go to Threat Intelligence → Product Intelligence → Synchronized Suspicious Objects to see correlation data from product intelligence suspicious objects.
    • Go to Threat Intelligence → Custom Intelligence → User-Defined Suspicious Objects to see correlation data from custom intelligence suspicious objects.
    A screen opens that displays the list of suspicious objects for the selected suspicious object type. If correlation data exists for a suspicious object in the list, the Correlation Data icon (icon-correlation.png) is displayed to the right of the suspicious object name.
    ddd-threat-intell-pr.png
    Synchronized Suspicious Objects
    ddd-threat-intell-cu.png
    User-Defined Suspicious Objects
  3. Click on the Correlation Data icon (icon-correlation.png).
    The Correlation Data screen opens.

What to do next

Use the Correlation Data screen for advanced analysis and to view threat histories for detected threats.
See Analyzing Correlation Data Information