Views:

Threat Connect

Threat Connect allows the administrator to view related threat information from the global intelligence database.

Data is only sent when the administrator manually clicks the “View in Threat Connect” button in the “Detection Details” view.

Data Collected
  • IP address
  • URL
  • host name
Console Location
  • The user manually triggers Threat Connect connection in the Detection Details view of Network Detections.

    Detections > Network Detections > Detection Details > Connection Details

    • View in Threat Connect

    Network Detections

  • The user manually triggers Threat Connect connection in the Detection Details view of an email detection.

    Detections > Email Messages > Detection Details > Connection Details

    • View in Threat Connect

    Email Messages

Console Settings

Back to top

Domain Exceptions

The administrator can add domains that they consider safe to an exception list.

Data is only collected when the administrator manually adds domain names on the management console.

Data Collected
  • Domain Name
Console SettingsAdministration > Network Analytics > Domain Exceptions

Domain Exception List

Back to top

Priority Watch List

The administrator can add servers that they consider high-priority for tracking and reporting.

Data is only collected when the administrator manually adds IP addresses on the management console.

Data Collected
  • IP address
Console SettingsAdministration > Network Analytics > Priority Watch List

Priority Watch List

Back to top

Registered Services

The administrator can add servers for specific services that their organization uses.

Data is only collected when the administrator manually adds domains name on the management console.

Data Collected
  • IP address
Console SettingsAdministration > Network Analytics > Registered Services

Registered Services

Back to top

Trusted Internal Network

The administrator can specify IP addresses or ranges to treat as part of their trusted internal network.

Data is only collected when the administrator manually adds IP addresses or ranges on the management console.

Data Collected
  • IP address
Console SettingsAdministration > Network Analytics > Trusted Internal Network

Trusted Internal Network

Back to top

Analysis Report - Correlated Events

The administrator can view the correlation data of a correlated event.

Data is only sent when the administrator manually clicks the “Correlation Data” icon on the “Correlated Events” screen.

Data Collected
  • IP address
Console SettingsDetections > Correlated Events

Analysis Report - Correlation Events

Back to top

Analysis Report - Synchronized Suspicious Objects

The administrator can view the correlation data of a synchronized suspicious object.

Data is only sent when the administrator manually clicks the “Correlation Data” icon on the “Synchronized Suspicious Objects” screen.

Data Collected
  • IP address
  • URL
  • Domain Name
  • File SHA-1
Console SettingsThreat Intelligence > Product Intelligence > Synchronized Suspicious Objects

Synchronized Suspicious Objects

Back to top

RCA Report

Endpoint analysis reports can be collected from Endpoint Sensor to help with correlation.

Data is automatically collected periodically when the administrator enables retrieval of endpoint analysis reports from Apex Central on the management console.

Data Collected
  • IP address
  • URL
  • Domain Name
  • File SHA-1
Console SettingsAdministration > Integrated Products/Services > Apex Central

Integrated Products

Back to top

Threat Connect in Correlative Events

Threat Connect allows the administrator to view related threat information from the global intelligence database.

Data is only sent when the administrator manually clicks the “Threat Connect” button in the “Correlation Data” view.

Data Collected
  • IP address
  • Domain Name
Console SettingsThe user manually triggers Threat Connect connection in the “Correlation Data” view of a correlated event.

Correlation Data

Back to top

Domain Tools in Correlative Events

The Domain Tools website allows the administrator to view related information for the item.

Data is only sent when the administrator manually clicks the “Domain Tools” button in the “Correlation Data” view.

Data Collected
  • IP address
  • Domain Name
Console SettingsThe user manually triggers “Domain Tools” connection in the “Correlation Data” view of a correlated.

Correlation Data

Back to top

VirusTotal

The VirusTotal website allows the administrator to view related information for the item.

Data is sent when the administrator manually clicks the “VirusTotal” button in the “Correlation Data” view.

Additionally, DDD-NAaaS may perform VirusTotal queries during analysis (for URLs only), which is not configurable and cannot be disabled.

Data Collected
  • IP address
  • Domain Name
  • URL
Console SettingsThe user manually triggers VirusTotal connection in the Correlation Data icon of correlated events of "Detections" menu.

Correlation Data

Back to top