Collect Network Analysis Package Task

After identifying a suspicious object that you want to investigate, you can collect the network analysis package (including an investigation package, a PCAP file, and a selected file detected by the network appliance) in a password-protected archive and download the file from the Response Management app.

1. After identifying the object that you want to collect, access the context or response menu and click Collect Network Analysis Package.

   The Collect Network Analysis Package Task screen appears.

2. (Optional) Specify a Description for the response or event.
3. Click Create.

   Trend Vision One creates the task and displays the current command status on the Response Management app.

4. Monitor the task status.
   1. Open the Response Management app.
   2. (Optional) Locate the task using the Search field or by selecting Collect Network Analysis Package from the Action drop-down list.
   3. View the task status.

      • In progress... (): Trend Vision One sent the command to the managing server and is waiting for a response

      • Successful (): The managing server successfully received the command

      • Partially successful (): The collection of one or more files was unsuccessful

      • Unsuccessful (): An error or time-out occurred when attempting to send the command to the managing server, the Security Agent is offline for more than 12 hours, or the command execution timed out

5. Download the network analysis package.
   1. In the Response Management app, find the Collect Network Analysis Package task and click the options button () at the right of the row.
   2. Click Download Package.
   3. On the screen that appears, record the password for the archived sample.
   4. Click OK to download the file.
      Tip:

      Use an external decompression program (such as 7-zip) to extract the file contents.