Configuring Suspicious Objects

A suspicious object is a known malicious or potentially malicious IP address, domain, URL, or SHA-1 value found in submitted samples.

Smart Protection Server can subscribe to the following sources to synchronize suspicious objects:

Table 1. Smart Protection Server Suspicious Object Sources


Suspicious Object Type


Deep Discovery Analyzer

  • Virtual Analyzer


Virtual Analyzer is a cloud-based virtual environment designed for analyzing suspicious files. Sandbox images allow observation of file behavior in an environment that simulates endpoints on your network without any risk of compromising the network.

Virtual Analyzer in managed products tracks and analyzes submitted samples. Virtual Analyzer flags suspicious objects based on their potential to expose systems to danger or loss.

Apex Central / Control Manager

  • Consolidated suspicious objects

  • User-defined suspicious objects

  • Virtual Analyzer suspicious objects


Deep Discovery Analyzer sends a list of suspicious objects to Apex Central / Control Manager.

Apex Central / Control Manager administrators can add objects they consider suspicious but are not currently in the list of Virtual Analyzer suspicious objects. User-defined suspicious objects have a higher priority than Virtual Analyzer suspicious objects.

Apex Central / Control Manager consolidates suspicious objects and scan actions against the objects and then distributes them to Smart Protection Server.

When subscribed, Smart Protection Server relays:
  • Suspicious URL information to Trend Micro products (such as Apex One, ScanMail, and Deep Security) that send Web Reputation queries
  • Actions against suspicious URLs to Security Agents that send Web Reputation queries.
  1. Go to Smart Protection > Suspicious Objects.
  2. Type the FQDN or IP address of the Suspicious Objects Source.
  3. Type the API Key obtained by the suspicious object source.
  4. Optional: Click Test connection to verify that the server name, IP address, and API key are valid, and that the source is available.
  5. Click Subscribe.
  6. To immediately synchronize suspicious objects, select Synchronize and enable suspicious objects and then click Sync Now.

    The option is available only if Smart Protection Server successfully connects to the source.

  7. Click Save.