Viewing Suspicious Connection Logs

  1. Go to Logs > Agents > Security Risks or Agents > Agent Management.
  2. In the agent tree, click the root domain icon () to include all agents or select specific domains or agents.
  3. Click View Logs > Suspicious Connection Logs or Logs > Suspicious Connection Logs.
  4. Specify the log criteria and then click Display Logs.
  5. View logs. Logs contain the following information:

    Item

    Description

    Date/Time

    The time the detection occurred

    Endpoint

    The endpoint on which the detection occurred

    Domain

    The domain of the endpoint on which the detection occurred

    Process

    The process that initiated the transmission (path\application_name)

    Local IP and Port

    The IP address and port number of the source endpoint

    Remote IP and Port

    The IP address and port number of the destination endpoint

    Result

    The result of the action taken

    Detected By

    The C&C list source that identified the C&C server

    Traffic Direction

    The direction of the transmission
  6. To save logs to a comma-separated value (CSV) file, click Export to All to CSV. Open the file or save it to a specific location.
Parent topic: Unknown Threat Logs