SonicWall Endpoint Security Administration Guide
Table of Contents
Viewing Threats
All threats are listed in a table at Threats page. The table lists the Tenant, Group, Alert Severity, Threat Name, Endpoint, User name, Process Status, File status, Reason, Local IP address, Threat ID and Time it was detected.
The table below shows the threats categories in detail:
| Options | Description |
|---|---|
| Tenant | Displays the list of threat detected tenants. |
| Group | Displays the list of threat detected groups. |
| Severity |
Displays the severity of threat detected. Low: Low severity threats processes are killed, and files are quarantined. Medium: Medium severity threats processes are not killed, and files are quarantined. High: High severity threats processes are killed and files are not quarantined. For more information, refer to Notifications section. |
| Threat Name | Displays the Threat file name. |
| Endpoint | Displays the threat detected endpoint detail. |
| User name | Displays the user name of the endpoint. |
| Process Status |
Displays the process status of threat detected. Killed: Indicates the status of auto-remediation, and the process is killed based on the custom rules and enabled threat detection policies. Not Killed: Indicates the actionable alerts and based on the severity process will be addressed. |
| File Status |
Displays the file status of threat detected. Quarantined: This indicates the status of auto-remediation and the file is quarantined based on the custom rules and enabled threat detection policies. Not Quarantined: Indicates the actionable alerts and based on the severity file will be examined. For more information, refer to Custom Rules section. |
| Reason | Displays the reason for the threat detection such as On Command Execution, On Download, On Scan, In Memory, On Image Load, On Process Behavior, and Custom Rules. For more information, refer to Notifications section. |
| Local IP | Displays the local IP address. |
| Threat ID | Displays the Threat ID. |
| Created At | Displays the threat created date/days /hours. |
To refine the search for specific issues, click on the Filter icon. It expands and you can select a combination of parameters to filter against.
You also have the options:
- Info: Click the Info level tiles to filter the information level.
- Severity: Click the Severity level (Low or Medium or High) tiles to filter the total number of threat detected based on the severity.
- Download: Click Download to get the threats in CSV file.
- Clear: Click Clear to refresh data.