A suspicious object is a known malicious or potentially malicious IP address, domain, URL, or SHA-1 value found in submitted samples. As configured, TMWS obtains suspicious objects from the following two sources:
Cloud Virtual Analyzer
Trend Micro Apex Central™
After obtaining the suspicious objects, TMWS can choose to implement them for threat detection based on the configured policies.
For an on-premises gateway, it can also obtain suspicious objects from a Trend Micro Deep Discovery™ Analyzer (DDAn) server after it is integrated with the server and Custom Defense is enabled on the on-premises gateway's web console. For more information, see Configuring Custom Defense.
Status: Whether or not (: enable or : disable) to apply a suspicious object during policy enforcement and take the corresponding action as configured upon detection. Click the icon to enable or disable a suspicious object.
Type: Type of a suspicious object. Options include Domain, File, IP, and URL.
Suspicious Object: Object generated and recognized as suspicious by the Cloud Virtual Analyzer or synchronized from Apex Central.
File: File that contains the suspicious object upon most recent detection. Click the file name to view the corresponding log under Logs & Reports.
Source: Source that a suspicious object is obtained from. Options include:
Cloud Virtual Analyzer: For more information about the Cloud Virtual Analyzer, see About Cloud Virtual Analyzer.
Apex Central: For more information on how to integrate with Apex Central, see Integrating with Trend Micro Apex Central.
For the same suspicious object, its information is subject to what is synchronized from Apex Central, for example, the expiration time.
For the suspicious objects generated by DDAn will display on the web console of each on-premises gateway integrated with DDAn, and not on this screen.
Last Generated: Latest date and time when a suspicious object is generated by the Cloud Virtual Analyzer or synchronized from Apex Central. This information changes when the same suspicious object is detected in another file.
Expires at: Date and time when a suspicious object expires.
Suspicious object from the Cloud Virtual Analyzer: By default, expires in 30 days once generated, and is automatically removed from the list after expiration. This information changes with the date and time under Last Generated.
Suspicious object from Apex Central: Subject to the expiration time carried in the synchronized information.
If there are many entries in the table, type some characters in the Search text box to narrow down the entries. As you type, the entries that match the characters you typed are displayed immediately. TMWS searches all cells in the table for matches.
For more information, see Configuring the Cloud Virtual Analyzer and Applying Suspicious Objects.