Viewing User-Defined Suspicious Objects

  1. Go to Threat Intelligence > Custom Intelligence > User-Defined Suspicious Objects.

    The User-Defined Suspicious Objects screen appears.

  2. Click the drop-down for detection type and then select one of the following detection types:
    • All (default)

    • IP addresses

    • URLs

    • File SHA-1

    • Domains

  3. To configure display settings, hover over the Network Detections or Email Messages icon in the column title and select Display Settings.

    The Display Settings dialog appears.

  4. Select a time period.
  5. Select which appliances to include as data source, and domains from which email messages should be displayed.
    Note:

    The time period, data source, and monitored domain filters only affect the Detections numbers.

  6. To run a search, type an IP address, domain, URL, SHA-1 hash value, or description keyword in the search text box, and then press ENTER or click the magnifying glass icon.
  7. (Optional) Click a number in the Network Detections or Email Messages column to drill-down to the Network Detections or Email Messages screen with filters applied.
  8. (Optional) Click on the column titles to sort the list of user-defined suspicious objects.