Technical Library | eSupport
Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Working with RiskVision Incidents : RiskVision Transaction Viewer table columns
RiskVision Transaction Viewer table columns
52011 | Incidents | TRITON RiskVision | v2.0 | 24-Sep-2015
Use the Show/Hide Columns drop-down list to configure the Transaction Viewer table to display any of the following columns.
Note that the columns are shown below in alphabetical order; the order in the Show/Hide Columns list depends on which entry is selected in the View list.
 
Column
Description
Analytic-Assigned Category
The URL category assigned to the incident by the analytic that returned the highest severity level
Different analytics may return different URL category results for the same incident.
Attack Stage
Describes which stage of the advanced malware threat kill chain the analyzed file corresponds to
See RiskVision attack stage definitions.
Client IP
IP address of the client machine
*
If X-Forwarded-For information is sent by an upstream proxy, this is the IP address of the client machine. (In this configuration, the Source IP field shows the proxy IP address.)
*
If X-Forwarded-For is not used in your deployment, the Client IP and Source IP fields contain the same IP address.
Cloud App
The name of a cloud app accessed as part of an incident (for example, LiveJournal or Facebook)
For more information about investigating cloud app incidents, see Using RiskVision to Investigate Cloud App Use.
Cloud App Risk
The risk level (low, medium, or high) assigned by Cloud App Analysis to the cloud app associated with an incident
Refer to the incident details for information about how risk level was determined for a specific cloud app.
Content Classifier
The type of string that Data Analysis matched to find a violation
*
For data loss incidents, the Data Content field shows the policy type (such as PCI), and the Content Classifier shows the rule within the policy that was matched (such as Credit Card Numbers).
*
For data theft incidents, the Data Content and Content Classifier values often match.
Data Content
The general type of content that Data Analysis found (for example, "PCI" or "Suspected malware communication")
Destination IP
The IP address of the recipient of an HTTP request
Email Subject
Content of the Subject line of an email message
File Hash
An SHA-1 hash of the file name associated with an incident, used to determine whether a file has been previously analyzed
File Name
The name of the file that was analyzed
File Size
The size, in bytes, of the file analyzed
Forwarded For
The content of the X-Forwarded-For string (if available) in an HTTP header. Used to identify the true source of a proxied transaction.
If an upstream proxy inserts X-Forwarded-For data, the Forwarded For and Client IP fields should match. The Source IP field will show the IP address of the proxy.
From Address
Identifies the sender of an email message
Full URL
The entire URL associated with an HTTP transaction
HTTP Return Code
HTTP status code returned in response to a request
Examples include 200 (OK), 301 (Moved permanently), 401 (Unauthorized), 404 (Not found), and so on.
Incident Time
Date and time the incident occurred
In the case of manually submitted pcap files, this is the timestamp recorded when the pcap was created; not the time that RiskVision analyzed the incident.
Method
HTTP method used in the transaction: GET, PUT, POST, CONNECT, and so on
Number of Categories
The total number of URL categories assigned to an incident during the process of analysis
PCAP Location
Full path to the pcap file associated with an incident in the appliance file system
Plugins
List of analytic plugins used to analyze the incident
Protocol
HTTP / SMTP
Reason
A string that includes a summary of:
*
A numeric internal code for the analytic that identified the malicious software
*
The threat name (corresponding to the Threat Name column in the table)
*
The attack stage (corresponding to the Attack Stage column in the table). See RiskVision attack stage definitions.
*
The channel used to spread the attack (Web or Email)
*
An internal alphabetic code for the analytic that identified the malicious software
Session
Unique identifier for the TCP session in which the incident was detected
Severity
The severity estimation returned by Data Analysis based on the type of data and number of violations
The possible severity values are high, medium, and low.
Source Host Name
The hostname of the source machine
Source IP
The IP address of the source of a request
If there is an upstream proxy, Source IP shows the proxy IP address and Client IP shows the client IP address.
Status
The status of the transaction analysis (for example, pending, in progress, or completed)
Threat Level
Malicious / Suspicious / No Threat Detected
A fourth threat level, "File Queued," may be displayed when an incident is in the process of being analyzed. This indicates that one or more of the plugins contributing to the analysis has not yet returned a result.
Threat Name
The name of the malware, if known, or a description of the type of malicious activity
Threat Score
A numeric value that combines analytic results to assess the potential severity of an incident
To Address
Identifies the recipient or recipients to whom an email was sent
URL Category Names
The name of each category returned by the URL database and content analysis for the URL associated with the incident
User Agent
The user agent header associated with an HTTP transaction
User Name
The name of the user who initiated an HTTP request
This requires integration with a product that provides X-Authenticated-For headers.
Violation Triggers
The strings that caused Data Analysis to return a policy violation
When specific triggers are displayed, potentially sensitive information is partially obscured.
X-Authenticated-User
The user name identified by the X-Authenticated-User header field in HTTP transactions passed by an upstream proxy
If you want to see the data for more columns than your monitor comfortably supports, it may be helpful to click the View details switch (next to the Filter box) and use the Details pane to review incidents. See Understanding RiskVision incident details for more information.

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Working with RiskVision Incidents : RiskVision Transaction Viewer table columns
Copyright 2015 Raytheon | Websense. All rights reserved.