Web Reputation Events

By default, the Vulnerability ProtectionDeep Security Manager collects Web Reputation Event logs from the Vulnerability ProtectionDeep Security Agents/Appliances at every heartbeat. The data from the logs is used to populate the various reports, graphs, and charts in the Vulnerability ProtectionDeep Security Manager.

Once collected by the Vulnerability ProtectionDeep Security Manager, Event logs are kept for a period of time which can be set Administration > System Settings > Storage. The default setting is one week.

From the main page you can:

• View () the properties of an individual event
• Filter the list: Use the Period and Computer toolbars to filter the list of events
• Export () the event list data to a CSV file
• View existing Auto-Tagging () Rules.
• Search () for a particular event

Additionally, right-clicking an Event gives you the option to:

• Add Tag(s): Add an Event Tag to this event (See Event Tagging.)
• Remove Tag(s): Remove exiting event Tags
• Add to Allow List (): Add the URL that triggered this Event to the list of Allowed URLs. (To view or Edit the Allowed and Blocked lists, go to the Exceptions tab on the main Web Reputation page.)
• Computer Details: View the Details window of the computer that generated the log entry

Columns for the Web Reputation Events display:

• Time: Time the event took place on the computer.
• Computer: The computer on which this event was logged. (If the computer has been removed, this entry will read "Unknown Computer".)
• URL: The URL that triggered this event.
• Tag(s): Event tags associated with this event.
• Risk: What was the risk level of the URL that triggered the event ("Suspicious", "Highly Suspicious", "Dangerous", "Untested", or "Blocked by Administrator").
• Rank: Rank provides a way to quantify the importance of events. It is calculated by multiplying the asset value of the computer by the severity of the rule. (See Ranking.)
• Event Origin: Indicates from which part of the Vulnerability ProtectionDeep Security System the event originated.

View Event Properties

Double-clicking an event displays the Properties window for that entry which displays all the information about the event on one page.

Reclassify: If you feel that site safety ratings or the classification of a particular site is incorrect, please send feedback to Trend Micro through the Site Safety Center at http://sitesafety.trendmicro.com.

Add to Allow List...: Use the Add to Allow List... button to add this URL to the Allowed URLs list. (To view or Edit the Allowed and Blocked lists, go to the Exceptions tab on the main Web Reputation page.)

The Tags tab displays tags that have been attached to this Event. For More information on Event tagging, see Policies > Common Objects > Other > Tags, and More About Event Tagging in the Reference section.

Filter the List and/or Search for an Event

Selecting "Open Advanced Search" from the "Search" drop-down menu toggles the display of the advanced search options.

The Period toolbar lets you filter the list to display only those events that occurred within a specific timeframe.

The Computers toolbar lets you organize the display of event log entries by computer groups or computer Policies.

Advanced Search functions (searches are not case sensitive):

• Contains: The entry in the selected column contains the search string
• Does Not Contain: The entry in the selected column does not contain the search string
• Equals: The entry in the selected column exactly matches the search string
• Does Not Equal: The entry in the selected column does not exactly match the search string
• In: The entry in the selected column exactly matches one of the comma-separated search string entries
• Not In: The entry in the selected column does not exactly match any of the comma-separated search string entries

Pressing the "plus" button (+) to the right of the search bar will display an additional search bar so you can apply multiple parameters to your search. When you are ready, press the submit button (at the right of the toolbars with the right-arrow on it).

Export

Clicking the Export... button exports all or selected events to a CSV file.

Auto-Tagging

Clicking Auto-Tagging... displays a list of existing Web Reputation Auto-Tagging Rules.