Viewing User-Defined Suspicious Objects

Procedure

1. Go to Threat Intelligence → Custom Intelligence → User-Defined Suspicious Objects.
   The User-Defined Suspicious Objects screen appears.
2. Click the drop-down for detection type and then select one of the following detection types:
   • All (default)
   • IP addresses
   • URLs
   • File SHA-1
   • File SHA-256
   • Domains
3. To run a search, type an IP address, domain, URL, SHA-1 hash value, SHA-256 hash value, or description keyword in the search text box, and then press ENTER or click the magnifying glass icon.
4. (Optional) Click a number in the Network Detections or Email Messages column to drill-down to the Network Detections or Email Messages screen with filters applied.

   Note The Network Detections number only includes detections from Deep Discovery Inspector appliances. The Email Messages number only includes email messages from Deep Discovery Email Inspector appliances.

5. (Optional) To configure display settings, hover over the Network Detections or Email Messages icon in the column title and select Display Settings.
   1. Select a time period.
   2. Select which appliances to include as data source, and domains from which email messages should be displayed.

      Note The time period, data source, and monitored domain filters only affect the Detections numbers.

6. (Optional) Click on the column titles to sort the list of user-defined suspicious objects.