infected file originated from

[joshuaer]

Hello,

When investigating a threat detected, is there a way to see how the infected file got on the machine? Is secure endpoint able to track it from a website, email, USB, etc?

Thanks

[Ken Stieers · Accepted solution]

If you look at the machine trajectory, and trace back the file in question, you can see what process dropped the file on the disk.
>From that you can deduce web site/email, etc.
If you have ESA/WSA in place and they're using AMP, they can be connected to AMP cloud and SecureX Threat Response and you'll see the file as sightings there as well.