Cisco CES AMP File Analysis report - Top 100 clarification

[mrjelly]

Hello,

I am running some reports from CES for AMP file analysis and have chosen a time frame of 6 months looking at the top 100.

However all the top 100 are within the last month. Can anyone tell me what this metric is? Is it just the most recent 100 or is it the top time taken to analyse?

Thank you

[mrjelly · Accepted solution]

Further to this, I have found out the top 100 is the top 100 results that match the SHA256 search criteria that can be put into the report.