Views:

After identifying a suspicious file object, you can submit the object for analysis in the Sandbox Analysis app using context menus on the Trend Vision One console.

This task is supported by the following services:
  • Trend Vision One
    • Windows agent
    • Mac agent
  • Apex One as a Service
    • Windows agent
    • Linux agent
  • Trend Cloud One - Endpoint & Workload Security
    • Windows agent
    • Linux agent
    • Mac agent
  • Deep Discovery Inspector
  • Virtual Network Sensor

Procedure

  1. After identifying the object that you want to collect, access the context or response menu and click Submit for Sandbox Analysis.
    The Submit to Sandbox for Analysis Task screen appears.
  2. (Optional) Specify a Description for the response or event.
  3. (Optional) Specify the arguments that are used when the sandbox runs the submitted file object.
    A maximum of 1,024 characters can be entered.
  4. Click Create.
    Trend Vision One creates the task and displays the current task status in Response Management.
  5. Monitor the task status.
    1. Open Response Management.
    2. (Optional) Locate the task using the Search field or by selecting Submit for Sandbox Analysis from the Action drop-down list.
    3. View the task status.
      • Pending approval (pending-approval.jpg) (if applicable): The automated response task was created on the Workbench app and is waiting for approval
      • Rejected (rejected.jpg) (if applicable): The automated response task created on the Workbench app was rejected
      • In progress (in-progress.jpg): Trend Vision One sent the command and is waiting for a response.
      • Queued (queued.jpg): The managing server queued the command because the agent was offline.
      • Successful (successful.jpg): The command was successfully executed.
      • Unsuccessful (error.jpg): An error or time-out occurred when attempting to send the command to the managing server, the Security Agent is offline for more than 12 hours, or the command execution timed out.
  6. Check the Sandbox Analysis by selecting Check Sandbox Analysis (sandbox-analysis-thr.png) to view the analysis result in the Sandbox Analysis app.
    For more information about the Sandbox Analysis app, see Sandbox Analysis