Knowledge Base

Devices

A list of all devices is provided on the devices tab, as well as the following information:

• Nebula Name
• Group
• Device Status
• Status
• Last Scan date
  
• Last Seen date

Any device requiring attention will show Need attention as the device status.

Detections

The Detections tab provides an overview of all threats detected on your endpoints. All files in the Detections tab have been identified, analyzed, and responded to in real-time, minimizing potential damage.

In the event of a false positive, you can automatically create an exclusion by selecting the threat and clicking +Create Exclusion.

The following information is provided about each threat:

• Status
  
• Category
• Threat
• Device and Device group
• Scan date

Clicking on the threat status brings up the threat drawer, which provides more insight into the detection. This includes:

• Executable/File detected
• Path
• Filetype
• Action Taken
• Threat Category
• Device Group
• Scanned at/Reported at timestamps

Files that have been quarantined can be restored or deleted via the threat drawer as well.

Quarantine

Quarantined files are detections that match a certain signature or other potential threat detail but may be false positives. If a potential threat is quarantined, this tab will allow you to restore or delete the file.

Suspicious Activity

Suspicious Activity watches for potentially malicious behavior by monitoring the processes, registry, file system, and network activity on the endpoint. Suspicious Activity Monitoring uses machine learning models and cloud-based analysis to detect when questionable activity occurs.

Please note that not all detected activity is guaranteed to be malicious; benign system operations can also trigger some detections.

How to export reports

Endpoint Detection and Response provides a multitude of reports that provide the information you need when you need it. To create a report, navigate to the reporting tab of Endpoint Protection and select +Create report in the upper left corner.

Create a name for the report, and select the type of report required. Next, input the desired time zone and click Continue.

If you want the report to be created automatically, enter the desired schedule (monthly, daily, or weekly). You can also set it to on-demand only to run when needed.

Set the desired reporting period - the dates to be included in the report. You can set a pre-defined period for each report or manually enter the periods each time you run the requested report.

In the final step, add the recipients to receive the report. Click Create to finalize and run the initial report.

Generate and send report

Regardless of whether on-demand or scheduled report, you can run any report on-demand by selecting the desired report and clicking ↻ Generate and Send the report.