Manage TDR Indicators

• Score — The threat score for this indicator. By default, this column is filtered to show scores of 6 or higher.
  For more information, go to About TDR Threat Scores.
• Source — The source of the indicator: Host Sensor (), Firebox (Network) () or both if the indicator is correlated.
• Indicator — The indicator details. You can filter this column by indicator type, as described in the next section. To view more details, click Additional Info.
• Last Seen — The last time the indicator was received from the Host Sensor. By default, this column is filtered to show indicators last seen in the last 24 hours.
• Sensor Status — The status of the Host Sensor.
  For more information, go to Manage TDR Hosts and Host Sensors.
• Host/IP — The host name or IP address of the host system.
• Action Requested — The action recommended by Threat Detection and Response for an indicator from a Host Sensor.
• Outcome — Indicates the status of the action listed in the Action Requested column.
• No Policy indicates that there is no policy to take action on this threat.
• Successful indicates that the action was successful and the threat was remediated.
• Failure indicates that the action failed due to a permissions issue or because the threat was remediated by another action.
• User — Shows the owner of the process or file that the indicator was created for.
• File Indicators — Shows the owner of the file.
• Process Indicators — Shows the owner of the process.
• Registry Indicators — No user information is displayed.
• Correlated Network Indicators — Shows the owner of the process that made the suspicious network connection.
• Uncorrelated Network Indicators — No user information is displayed.
• Action Date — The date and time that the remediation action occurred.
• Previous Score — Shows the previous score assigned to an indicator before a remediation action was completed. This column is not visible by default.
• For Further Investigation — Contains links you can click to search for the MD5 on Google, VirusTotal, and MetaScan.

1. Select the column settings you want to save.
2. In the far left column heading, click .
3. Select Save.

1. In the far left column heading, click .
2. Select Apply.

1. In the far left column heading, click .
2. Select Clear.

1. In the far left column heading, click .
2. Select Remove.

1. In the column heading, click .
   A date selection dialog box appears. The selected date range filter, if any, appears at the top.

2. Select the start and end date on the calendar, or select a date range shortcut. The available shortcuts are:
   • Last 24 hours
   • Last 3 days
   • Last 7 days
   • Last 30 days
3. To apply the selected date range filter, click Apply.
4. To clear the date range filter, click Clear.

You can apply a filter to the Indicator column to view indicators by the indicator type.

For host indicators () reported by a Host Sensor, the indicator types are:

• File — a suspicious or malicious file
• Process — a suspicious or malicious process
• Registry — a suspicious or malicious registry entry on a Windows host
• Host Ransomware Prevention — processes and files with the characteristics of ransomware

For network indicators () reported by a Firebox, the indicator types are:

• Blocked Sites by Botnet
• Blocked Sites by FQDN
• Blocked Sites by IP
• DNS Question Match
• HTTP APT Blocked
• HTTP APT Detected
• HTTP Bad Reputation
• HTTP Request Categories
• HTTP Virus Found
• SMTP APT Blocked
• SMTP APT Detected
• SMTP Virus Found

For indicators reported by both a Host Sensor () and a Firebox (), the indicator types are:

• HTTP APT Detected and Found — APT Blocker response indicates the file is malicious and Host Sensor has returned the locations of the files for remediation.
• Process + Network — Correlates network events from the Firebox to an individual process on the host. (Only available for Windows Host Sensors.)

You can also view the full log message generated by the Firebox for each network event on the Network Events page. For network indicators, each indicator corresponds to a different event type. For more information, go to View Network Events in TDR.

Indicator Scores

TDR analytics assigns each indicator a score based on the severity of the threat. 10 is the highest level threat, and 2 is the lowest. TDR assigns a score of 1 if an indicator was successfully remediated, and a score of 0 if an indicator is on the Allowlist.

For more information about indicator threat scores, go to About TDR Threat Scores.

For more information about remediation actions and threat scores, go to TDR Remediation Actions and Threat Scores

1. On the Indicators page, find the indicator.
2. In the Outcome column for the indicator, click .

3. Click Close to close the Action Log.

1. Select ThreatSync > Indicators.
2. In the Indicator column, click Additional info.
   The Additional Information dialog box opens.

The additional information that appears depends on the source of the indicator. The source could be a Host Sensor, a Firebox, or both.

Indicators from a Host Sensor —

For an indicator reported by a Host Sensor, the Additional Information dialog box shows information about how analytics calculated the indicator score. It shows information about three components of the score: Threat Feed, Malware Verification Service, and Heuristics. The status for each indicator is highlighted.

Threat Feed status options:

• Not Matched — The file or process is not the same as anything in the Threat Feed
• Matched — The file or process is the same as something in the Threat Feed

Malware Verification Service (MVS) status options:

• Benign — MVS identified that the file or process is known to not be a threat
• Unseen — MVS does not have information about the file or process
• Potential — MVS identified that the file or process is a known potential threat
• Malicious — MVS identified that the file or process is a known threat

Heuristics status options:

• Below Threshold — The observed behavior of this file or process is not known to be suspicious
• Suspicious — The observed behavior of this file or process is suspicious. If machine learning was used to determine the status, (ML) appears next to the Suspicious label.

To view more information about the suspicious event, click Details.

If the hash for this indicator was found on other hosts, the top-right corner of the Additional Information dialog box shows the number of other host sensors that identified this indicator. To view a list of all hosts that identify this indicator, click Hash found on other host(s).

If the Host Sensor requests the Sandbox File action, the Additional Information dialog box also includes information about the status of Sandbox Analysis by APT Blocker.

For more information, go to TDR Sandbox Analysis by APT Blocker.

Indicators from a Firebox (Network) —

For an indicator reported by a Firebox, the Additional Information dialog box shows information about the threat reported by the Firebox.

You can view more details about network events identified by a Firebox on the Network Events page. For more information, go to View Network Events in TDR.

1. Click the type of chart to generate:
   • — Bar Chart
   • — Pie Chart
   • — Stacked Bar Chart

The selected chart appears

2. To change the date range shown in the chart, select a date range at the top.
3. From the Group By drop-down list, select how to group the data in the chart.
4. From the Show drop-down list, select how many indicators to show in the chart.
5. To export the chart, click and select the export file format: .PNG, .JPG, .GIF, or .PDF.
   The file is downloaded in the selected format.

1. Select the check box for one or more indicators.
2. From the Actions drop-down list, select the action to complete.
   A confirmation dialog box opens, with a list of the indicators the selected action applies to.

3. Click Execute Action.