Understanding RiskVision incident details

Incidents | TRITON RiskVision | v2.1 | 02-Jun-2016

To see more details about an incident, enable the View Details toggle on the Incidents page, then click on an incident to select it. A panel is added to the bottom of the table, showing any additional details that are available.

For the selected incident, the detail panel shows:

Every viewable field in the database that has a value assigned to it. (Fields without a value are hidden.)

In addition to the columns that can be displayed in the File Analysis table, the General tab of the Details pane may contain the following fields:


Field	Description
Destination Port	Port on which a request was received
File Type	A description of the type of file associated with the incident, which may correspond with a common file extension (like EXE or JPG)
SHA-1 Hash	The SHA-1 hash of the file associated with the incident (displayed in the table as "File Hash") Used by the File Sandboxing cloud service
SHA-256 Hash	The SHA-256 hash of the file associated with the incident Used by VirusTotal
Source Port	Port on which a request was sent
Time Report Completed	The time the most recent incident assessment report finished generating
Transaction ID	An internal identifier provided by Transaction Processor
Transactional Processing Flags	Comma-separated list of labels appended to the incident record during analysis For example, if Local Analysis flags an incident for file analysis by File Sandboxing or Threat Protection, the OffBoxScanRequired label is listed in this field.
VirusTotal	A link to VirusTotal that includes the SHA-256 hash of the file associated with the incident Click the link to find out if a VirusTotal report exists for the file.

Information about the Cloud App (if any), including a summary of the factors contributing to the App Risk value shown.

See Using RiskVision to Investigate Cloud App Use for more information about finding cloud app data and understanding cloud app risk factors.

Advanced information from each of the analytic tools used to assess the incident.

Click View Unformatted Results in any section of the Advanced tab to see the raw data returned by the selected analytic in a pop-up window.

Position the mouse over any truncated string in the detail panel to see the full string.