How to view Threat Reports (Capture ATP)

03/26/2020 93 11804

DESCRIPTION:

This article shows you how to view and read Threat Reports for Capture ATP.

• Launching the Threat Report from the Captrue ATP Logs Table.
• Viewing the Threat Report Header.
• Viewing the Threat Report Footer.
• Viewing the Static File information
• Viewing Threat Reports from Preprocessing
• Viewing Threat Reports form a Full Analysis

Note: The report format varies depending on whether a full analysis was perfomed or the judgment was based on preprocessing.

RESOLUTION:

1. Launching the Threat Report from the Captrue ATP Logs Table.

Navigate to Capture ATP > Status page | Click on any row in the logs table to launch the threat report in a new browser window.

Note: An exception exists for archives which do not contain any supported types. In this case, no threat report is launched.

2. Viewing the Threat Report Header.

This section describes the header componets and variations.

Colored banner:

• The Colored banner is red for a malicious file, and blue for a clean file.
• The top entry displays the date and time that the file was submitted to Capture ATP for analysis.
• Below the date and time, a summary of the result is displayed.

Lower banner:

• The lower part of the banner contains the connection information.
• On the left is the IP address (IPv4) and port number of the connection source. This is the address from which the file was sent.
• In the middle is the firewall identified by its serial number or friendly name.
• On the right is the IP address (IPv4) and port number of the connection destination. This is the address to which the file is being sent.

3. Viewing the Threat Report Footer.

• MD5
• SHA1
• SHA256

• Serial Number   This is the serial number of the firewall that sent the file. This is not displayed if the file was manually uploaded.
• Capture ATP Version   This is the software version number of the Capture ATP service running in the cloud.
• Report Generated   This is the timestamp in UTC format of when the report was generated.

The static file information is displayed on the left side of the threat report, and is similar across all types of reports.

The file information includes:

• File size in kilobits (kb)
• File type
• File name as it was intercepted by the firewall

5. Viewing Threat Reports from Preprocessing

There are varying amounts of data on a preprocessor threat report, based on whether the file was found to be malicious or clean.

Preprocessor threat report for a malicious file:

The above threat report format is seen when the virus scans reveal malware in the file.

Preprocessor threat report for a clean file:

• Virus scans are inconclusive or all good.
• The file matches domain or vendor allow lists.

• Virus scans are inconclusive or all good.
• No embedded code is present in the file.

?More information about preprocessor reports will be discussed in the following two sections.

6. Viewing Threat Reports form a Full Analysis

Full analysis threat reports provide the same set of information for both malicious and non-malicious files, although the banner color is different.

6.3 Analysis Engine Results Tables

Under the status boxes, the full analysis threat report displays multiple tables showing the results from each analysis engine. The engines are designated by names from the Greek alphabet, such as Alpha, Beta, Gamma, etc. Each row represents a separate environment, and indicates the operating system in which the engine was executed.