What information does this report provide
The Threat Watch alert report provides a consolidated view of the statistics of all the impacted resources for which malicious data is found within a specified period.
How does the report help
You can leverage this report to get insights about:
Resource Name
Resource Type
vCenter/ESXI Host (Only for VMware resource type)
AWS Account
Region
Subscriptions
Organization Name
Number of Impacted Snapshots
First Matched Snapshot
Last Matched Snapshot
IOC library
With this report, you can proactively get insights into the list of impacted resources and take necessary actions such as isolate or quarantine the infected resources.
To access the report
You need to be a Druva Cloud Administrator.
Go to Druva Cloud Platform Console Global Navigation > Reports > Cyber Resilience > Threat Watch Alert Report.
Using the report
📝 Note:
By default, the period selected for the report is 30 days from the current date. For example, if today is March 31, 2024, the report displays data from March 1 to March 30, 2024.
The data in the reports is synced periodically. The report shows the Data last updated details.
The Threat Watch Alert Report comprises the following information:
Field | Description |
Resource Name | The name of the quarantined resource |
Resource Type | Type of quarantined resource - VMware, Azure VM, EC2 and EBS Volumes. |
vCenter/ESXI Host (Only for VMware resource type) | The vcenter/ESXI Host details in case of VMware resource type. |
AWS Account | Details of AWS account. |
Region | The region to which the resource belongs. |
Subscriptions | Subscription details for the report. |
Organization Name | The name of the organization to which the resource belongs. |
Number of Impacted Snapshots | The count of impacted snapshots found in the resource. |
First Matched Snapshot | The first snapshot details for which file matches were found. |
Last Matched Snapshot | The last snapshot details for which file matches were found. |
IOC library | The IOC details (File Hash or file extension) using which the scanning was performed. |
Actions
To leverage the report, you can perform the following actions:
Manage Reports: Learn how to subscribe to reports, apply filters, email reports, and edit existing subscriptions.
Custom Report Creation: Learn how to customize, and manage your own reports.
Related Article
Threat Watch