Technical Library | eSupport
Go to the table of contents Go to the previous page Go to the next page
Using TRITON RiskVision Reports : RiskVision presentation reports catalog
RiskVision presentation reports catalog
52022 | Using Reports | Websense TRITON RiskVision | 24-Sep-2015
You can generate several reports about malware and data loss incidents from the Reporting page in the RiskVision Local Manager.
 
Report Name
Description
Top Affected Devices
Provides information about the devices in your network (identified by IP address and hostname) with the largest number of data loss or malicious software incidents.
This report includes:
*
The total number of devices with malware or data loss activity in your network
*
A summary table that shows how many incidents of each type were seen on each of the top affected devices
*
An detail table with information about each malware threat detected on the devices described in the summary table
For data loss incident details, generate the data theft and data loss reports described below.
Exploit Kits and Dropper Files
Provides details about files associated with exploit kit and dropper file activity. The report includes:
*
The name and SHA-1 hash for each file to support further research
*
A description of the threat
This may match the Reason field in the Transaction Viewer (see RiskVision Transaction Viewer table columns), or provide a short, descriptive paragraph from the Websense Collective Threat Intelligence (CTI) cloud service.
*
The severity level that content analysis has assigned to the threat
Call Home Traffic
Provides details about files associated with call home traffic.
This report includes:
*
The name and SHA-1 hash for each file to support further research
*
A description of the threat
This may match the Reason field of the Transaction Viewer (see RiskVision Transaction Viewer table columns), or provide a short, descriptive paragraph from the Websense Collective Threat Intelligence (CTI) cloud service.
*
The severity level that content analysis has assigned to the threat
Data Theft
Provides information about data loss and data theft incidents seen in your network.
This report includes:
*
An summary report showing each client IP address associated with data loss and data theft incidents.
The table also shows how many data loss or data theft incidents originated from each machine, and the name of each violated policy.
*
A detail report that lists both the data loss or data theft policies that were violated, as well as the specific rules violated within each policy.
Top Destinations for Data Loss and Malware Incidents
Lists destination IP addresses and domains correlated with the number of data loss and malicious software incidents associated with each.
Data Loss Incidents by Policy
Provides information about the data loss policies that were violated by users or malicious software in your network.
This report includes:
*
A pie chart showing the polices that were violated
*
A table correlating each violated policy with source IP addresses
The table also shows the number of violations originating from each source machine.
Incidents by Traffic Direction
Offers a quick overview of the number of inbound and outbound incidents detected in a simple pie chart.
Incidents per Day
Shows incident trends over the course of the time period selected for the report. The report must include results for multiple days in order for the trend chart to be populated.
Top Cloud Apps by Risk Level
Provides information about potentially risky cloud apps visited by users in your network.
This report includes:
*
A Top App Summary, which shows the risk level, number of users accessing the app, and the total bandwidth consumed by traffic to and from the app.
*
A Risky Cloud Apps detail report, which includes the app name, URL, risk level, and description, as well as a summary of the number of users who have accessed the app, the amount of bandwidth consumed by traffic to and from the app, and the last time the app was accessed by users in your network.
Top Users of High Risk Cloud Apps
provides information about the users accessing potential risky cloud apps from your network.
This report includes:
*
A Top User Summary, showing the clients (by user name or IP address) who most frequently access potentially risky cloud apps, as well as how many potentially risky cloud apps each has accessed.
*
A High Risk Cloud App Users report, listing each client (by user name or IP address) and each high risk cloud app the client accessed.
In addition to the reports, you can also include supporting materials for the report you selected.
*
A graphical cover page that includes the report title and the date the report was generated
*
An introduction that includes information about understanding threat stages to help recipients understand malware-related information in the report
*
A closing page with resources for further investigation offered at websense.com

Go to the table of contents Go to the previous page Go to the next page
Using TRITON RiskVision Reports : RiskVision presentation reports catalog
Copyright 2015 Raytheon | Websense. All rights reserved.