topic Re: Full location of affected threat URL/filename? in General Topics

Full location of affected threat URL/filename?

Khang_Than-Trong — Thu, 25 Jun 2015 19:51:49 GMT

Troubleshooting what I think is a false positive but the Detailed Log View (under Threats monitoring) only shows the filename and not its full location on the HD of the machine. Is there any way to find out the full location?

Re: Full location of affected threat URL/filename?

Raido_Rattameister — Fri, 26 Jun 2015 07:11:05 GMT

Data filtering log.

Click on magnifying glass and bottom right there is url column where you can see full url.

Re: Full location of affected threat URL/filename?

Khang_Than-Trong — Fri, 26 Jun 2015 15:23:26 GMT

Thanks for the reply. Do you mean the magnifying glass that brings up the "Detailed Log View?" Its URL column only indicates "setup.exe" in this example, and not the full disk path. I wonder if that's available anywhere?

Re: Full location of affected threat URL/filename?

Raido_Rattameister — Fri, 26 Jun 2015 15:45:08 GMT

Yes

It depends on application.

Go and browse the web.

Download some pdf or doc from internet for example.

Go and find log entry for this file.

And you should see referer link there.

If not then copy ip of other side and paste it to URL filtering log.

Probably as destination. For example

( addr.dst in 194.106.121.19 )

Re: Full location of affected threat URL/filename?

Khang_Than-Trong — Fri, 26 Jun 2015 15:48:45 GMT

In this case, it is *originating* from an internal machine to another, and the only URL listed is the filename without its fixed disk location. I am guessing the filename + the originating machine is as much information as it will have since that info isn't on the network info without some sort of agent on the originating machine. I'm trying to find out where on that originating machine it is located.

Re: Full location of affected threat URL/filename?

Raido_Rattameister — Fri, 26 Jun 2015 15:53:18 GMT

So it is SMB traffic (Windows file share)?

Re: Full location of affected threat URL/filename?

Khang_Than-Trong — Fri, 26 Jun 2015 15:54:16 GMT

Yes, it's SMB traffic. Whoops forgot to mention that.

Re: Full location of affected threat URL/filename?

Raido_Rattameister — Sat, 27 Jun 2015 05:30:28 GMT

I doubt that you see UNC path anywhere.

For example you can't block traffic based on UNC path Dynamic Block Lists and UNC Server Path