Reports on detections

Hello ANT1,

select the machine in SEC
you View Computer Details? Last Friday should still be listed under History.

didn't get an email
you have enabled Email Alerting from your endpoints in the AV and HIPS policy or Email Alerts ... from the console?

Christian

Hi QC,

Yes, when I view the history of the machine is it listed as a detection. BUT the Console dashboard is not reflecting this. I thought that if there was a detection it would show up in the dashboard and this one isn't. Obviously I cannot view each machine history individually.

Email alerting is configured on the console, AND it's enabled in the policy.

Any ideas?

Thank you

Hello ANT1,

if there was a detection it would show up in the dashboard
the dashboard (as well as the Status/Alerts and errors column and the Alert and Error Details tab) shows only outstanding alerts, i.e. detections that haven't been (properly) dealt with. A successful cleanup, delete, or move action, in addition an Acknowledge from the console, a Clear from list in the local QM clears the alert. For detections that can be authorized an authorization (QM, local settings, policy change) also clears the alert.
The report and the history should have an associated entry that names the Action taken. The Dashboard shows the current situation, not any statistical (apart from the percentages) or historical data. The latter are provided by the reports.

SEC sends an email when a threshold is exceeded, i.e. a value "crosses the limit upwards". Subsequently the value has to fall below before another mail can be triggered. The message also doesn't contain any details like endpoint or threat name.

Finally email alerts from the endpoints: If enabled you should get an email even if a detection is never shown on the dashboard (because detection and cleanup notification are sent to SEC in a single message). It may fail for various reasons thus the question is - did you ever receive an email from this endpoint?

Christian

Hello ANT1,

if there was a detection it would show up in the dashboard
the dashboard (as well as the Status/Alerts and errors column and the Alert and Error Details tab) shows only outstanding alerts, i.e. detections that haven't been (properly) dealt with. A successful cleanup, delete, or move action, in addition an Acknowledge from the console, a Clear from list in the local QM clears the alert. For detections that can be authorized an authorization (QM, local settings, policy change) also clears the alert.
The report and the history should have an associated entry that names the Action taken. The Dashboard shows the current situation, not any statistical (apart from the percentages) or historical data. The latter are provided by the reports.

SEC sends an email when a threshold is exceeded, i.e. a value "crosses the limit upwards". Subsequently the value has to fall below before another mail can be triggered. The message also doesn't contain any details like endpoint or threat name.

Finally email alerts from the endpoints: If enabled you should get an email even if a detection is never shown on the dashboard (because detection and cleanup notification are sent to SEC in a single message). It may fail for various reasons thus the question is - did you ever receive an email from this endpoint?

Christian