topic Re: Threatgrid Files in Endpoint Security

Threatgrid Files

lsmarchig — Fri, 21 Feb 2020 05:05:20 GMT

We are looking at ESA AMP\Threatgrid. Can the files that are uploaded to threatgrid for further analysis be deleted? If so, how would that be done exactly?

thanks

Re: Threatgrid Files

emirolyu — Fri, 12 Jan 2018 20:24:27 GMT

Hi Louis, I assume you're referring to Threat Grid Cloud. Yes, files can be deleted through Threat Grid Portal by the org admin, this is one of the features in the portal. If the customer doesn't have entitlements/licensing to access the portal, a support ticket can be open to remove a file.

Re: Threatgrid Files

lsmarchig — Mon, 15 Jan 2018 12:05:18 GMT

Hi Evegeny,

Thank you for that information, would you know if we can programmatically do these deletions via an api call or something like that? If so, is there documentation available? i havent had any luck in finding it so far.

thank you,

Re: Threatgrid Files

emirolyu — Tue, 16 Jan 2018 10:43:02 GMT

Hi Louis,

Delete sample is available through the Web UI today. I assume the question is about files submitted automatically by integrations (ESA, CES, WSA, FTD, Meraki, ...) - in this case, all the files are marked as private, meaning only the organization that submitted a sample can see it. This is well documented in the Threat Grid help, though requires a Threat Grid Portal account at panacea.threatgrid.com (eu). Alternative consideration, if there's a strict privacy concern, would be an on-prem Threat Grid appliance.

Re: Threatgrid Files

lsmarchig — Wed, 27 Jun 2018 10:19:26 GMT

Thank you Evgeny

Re: Threatgrid Files

jitumani.das — Thu, 05 Jul 2018 11:50:31 GMT

Thanks a lot