...
- Run a search on any of the available fields listed in the drop-down list next to the Search button.
- ACTION
- CLASS
- DEVICE IP
- DEVICE NAME
- DHCP FINGERPRINT
- DNS VIEW
- FEED (limited to a maximum of 100 returned records)
- MAC ADDRESS
- OS VERSION
- POLICY
- PROPERTY
- QUERY
- QUERY TYPE
- RESPONSE
- SOURCE (limited to a maximum of 100 returned records)
- THREAT CONFIDENCE
- THREAT LEVEL
- USER
- The = and the NOT (!=) operators
- Use AND and OR operators.
- Use single and double quoted to enter values with spaces.
- Use parentheses to group search parts.
- Use the wildcard symbol (*) as the last character of the search value for a partial match.
- Use the ENTER key to apply search.
- Use the TAB key to autocomplete search with the first available suggestion.
...
- Action: The configured action for the security rule. This can be Allow, Redirect, Block, or Log.
- Confidence: The threat confidence score assigned to an indicator. The confidence level can be High, Medium, or Low.
- Feed: The list of threat feeds against which the malicious hit was triggered. Limited Limited to a maximum of 100 returned records returned.
- Class: The threat intelligence feeds, such as Phishing, MalwareC2DGA, and others.
- Level: The threat level for the malicious hit. This can be High, Medium, Low, or Info. Note: In some cases, a record may not contain all fields which will be represented as N/A on the user interface and NULL in the API results.
- Policy: Active security policies.
- Source: The location of the device within the network infrastructure. For example, the device can be an on-prem appliance or an endpoint device. You can select which records to view by selecting or deselecting from among the options available. Limited to 100 records returned Limited to a maximum of 100 returned records.
Show: Security and activity events can be filtered by choosing an option from the Show drop-down menu.
Note title Note Depending on the availability of data records, not all filter options may be displayed.
...
- DETECTED: The timestamp when the hit was detected.
- THREAT LEVEL: The threat level for the malicious hit. This can be High, Medium, Low, or Info. Note: In some cases, a record may not contain all fields which will be represented as N/A on the user interface and NULL in the API results.
- QUERY: Displays the domain that sent the DNS query. Clicking
associated with a record allows you to view the Dossier threat look-up record of a threat class or property for the selected record. On the Dossier threat look-up page, you can view the Dossier report details for additional information on the selected record. - CLASS: The threat intelligence class, such as Phishing, MalwareC2DGA, and others.
- PROPERTY: The property or nature of the threat. By default, the portal includes all threat properties.
- POLICY: The security policy against which the malicious hit triggered.
- ACTION: The configured action for the security rule. This can be Allow, Redirect, Block, or Log.
- DEVICE NAME: The name or IP address of the device.
- SOURCE: The location of the device within the network infrastructure. For example, the device can be an on-prem appliance or an endpoint device. Limited to 100 records returned.
- RESPONSE: The response taken by BloxOne Cloud for the malicious hit.
- DNS VIEW: The DNS version data being served.
- FEED: The name of the threat feed against which the malicious hit triggered. Limited to 100 records returned.
- QUERY TYPE: The DNS query type.
- MAC ADDRESS: The detected MAC address of the device.
- DHCP FINGERPRINT: The unique identifier that was formed by the values in the DHCP option 55 or 60. This identifier is used to identify the requesting client or device.
- USER: The user that triggered the event. For remote offices, the portal displays Unknown for these users. If you have configured access authentication, this displays the authenticated user who triggered the event.
- THREAT CONFIDENCE: A scoring system for malicious hits where confidence is rated High, Medium, Low.
- DEVICE IP: The IPv4 or IPv6 address of the device responsible for the hit.
- OS VERSION: The version of the device's operating system making the request.
- INDICATOR: The policy source from which the indicator type being reported. The indicator can originate from an application or category filter, from a custom list, or from a feed.
- RESPONSE REGION: The region within a country where the response originated based on information acquired from the public IP address of BloxOne Endpoint and DFP,
- RESPONSE COUNTRY: The country where the response originated based on information acquired from the public IP address of BloxOne Endpoint and DFP,
- DEVICE REGION: The region within a country where the response originated.
- DEVICE COUNTRY: The country where the device resides.
...