The Analysis Chain screen provides details about a
Noteworthy Event and allows you to perform further investigation on noteworthy objects.
You can
also isolate or run an Aggressive Scan on the affected endpoint.
Use the Status drop-down list to change the event
status.
Click Action Taken to view a list of actions taken
upon the event.
Click 
and select Analysis Chain to export the Analysis
Chain to a ZIP file.
and select Analysis Chain to export the Analysis
Chain to a ZIP file.|
Information
|
Description
|
||
|
Endpoint
|
Displays details about the endpoint that was
investigated
Click
 and select Isolate Endpoint to
disconnect the endpoint from the network. During isolation, the Security Agent can
only
communicate with the server.Click
and select Start Aggressive Scan
to fix unresolved security risks.
|
||
|
First Observed Object
|
The first object in the analysis chain suspected to have
been responsible for the creation of the investigated object.
This is often the entry point of a targeted attack.
Hover over an object and click
 to locate the object in the
Analysis Chain. |
||
|
Security Threat
|
The detected threat that Worry-Free Services uses to
create the Noteworthy Event.
Hover over an object and click
to locate the object in the
Analysis Chain. |
||
|
Noteworthy Objects
|
Highlights objects in the chain that are possibly
malicious, based on existing Trend Micro intelligence
The value counts the number of unique noteworthy objects
in the chain.
Click to view the list of noteworthy objects.
Hover over an object and click
to locate the object in the
Analysis Chain. |
||
|
Analysis Chain
|
Displays a visual analysis of the objects involved in an
event
Click any available node to view more information about the
selected object.
For more information on how to interpret Analysis Chains,
see:
|
