topic Re: Cisco Endpoint Security Question in Endpoint Security

Cisco Endpoint Security Question

IamSamSaul — Fri, 19 Mar 2021 23:03:08 GMT

Hello,

Is there a way to check what happened to the malicious file when Cisco Endpoint Security detects a threat and generate an even.

When I enter the Sha-256 hash I can see other information but not what happened? For example: Threat detected and file was quarantined or file deleted.

Thanks & Regards,

Sam

Re: Cisco Endpoint Security Question

Ken Stieers — Fri, 19 Mar 2021 23:36:50 GMT

That should appear in the dashboard, events for the endpoint, the device trajectory...

Re: Cisco Endpoint Security Question

Troja007 — Mon, 22 Mar 2021 11:17:14 GMT

Hello @IamSamSaul, as @Ken Stieers already explained.
When checking the Event, you just need to open the Device Trajectory. In the example from the attached screenshot, i also filtered for the SHA256 hash of the malicious file.
Greetings,
Thorsten

Re: Cisco Endpoint Security Question

IamSamSaul — Thu, 25 Mar 2021 14:56:52 GMT

Thanks both Ken and Thorsten.