Overview
You can use the Download Report option to download Threat Hunt File Level and/or Snapshot level details for offline investigation and auditing purposes.
Use Summary Report to download and view the details of scanned files and Detailed Report to download and view snapshot details.
The data is downloaded in a compressed file format when you click the Download Report option. Following is the file naming convention of the downloaded file:
Summary Report: <Threat Hunt Name_Summary-<Date stamp>, <Time stamp>.<file extension of the compressed file format>For example, file level report for the Threat Hunt Test name will be downloaded as <Threat Hunt Test_Summary-Jul 13, 2024 09_47_25.zip>
Detailed Report: <Threat Hunt Name_Detailed-<Date stamp>, <Time stamp>.<file extension of the compressed file format>For example, detail report for the Threat Hunt Test name will be downloaded as <Threat Hunt Test_Detailed-Jul 13, 2024 09_47_25.zip>
What information does the Summary Report contain?
The Summary Report provides a summary of scanned files which includes the following information:
Threat Hunt Name
Threat Hunt Criteria
Status of Scan
Number of infected resources
Number of infected snapshots
Total number of malicious files found
Name of the administrator who created the Threat Hunt job
Date and time when the Threat Hunt job is initiated
Date and time when the Threat Hunt job completed
Name of the resource
Snapshot details such as name, status (ready or not ready for threat hunt) and size
Total number of scanned files
Total number of file matches found
Number of custom file hash matches found
Number of predefined file hash matches found
Number of custom file extension matches found
Number of predefined file extension matches found
What information does the Detailed Report contain?
The Detailed Report includes the following information:
Threat Hunt Name
Threat Hunt Criteria
Status of Scan
Number of infected resources
Number of infected snapshots
Total number of malicious files found
Name of the administrator who created the Threat Hunt job
Date and time when the Threat Hunt job is initiated
Date and time when the Threat Hunt job completed
Name of the resource
Snapshot details
Name of the malicious or infected file
File Path-Location of the malicious or infected file
Match criteria used to scan the file
Details of file matches—This displays the file hash and or file extension value entered during threat creation. File hash can be either SHA1, SHA-256, or MD5.
File type, size, creation, and modification time
SHA1 Checksum: The SHA1 value of the file being scanned.
Procedure
To download the report, perform the following steps:
From the DCP dashboard, go to the Global Navigation Menu ->Ransomware Recovery.
Select Threat Hunting from the Left navigation panel, the Threat Hunting dashboard appears.
On the Threat Hunt dashboard page, click the Threat Hunt Name for which you want to download the report.
On the Scan Results page, click Download Report > Detailed Report or File Summary Report. The data is downloaded in a compressed file format.