Cisco Endpoint Security Question

[IamSamSaul]

Hello,

Is there a way to check what happened to the malicious file when Cisco Endpoint Security detects a threat and generate an even.

When I enter the Sha-256 hash I can see other information but not what happened? For example: Threat detected and file was quarantined or file deleted.

Thanks & Regards,

Sam

[Ken Stieers · Accepted solution]

That should appear in the dashboard, events for the endpoint, the device trajectory...

[Troja007 · Accepted solution]

Hello @IamSamSaul, as @Ken Stieers already explained.
When checking the Event, you just need to open the Device Trajectory. In the example from the attached screenshot, i also filtered for the SHA256 hash of the malicious file.
Greetings,
Thorsten

[IamSamSaul]

Thanks both Ken and Thorsten.