Handling Potention Exploits

[jimmy.gonzalez]

Recently our company switched to Traps Endpoint protection.  Still in learning mode, and triggered a exploit protection, from what appears to be a word doc.  There is no upload to Wildfire, (thought I did manually retrieve the file and upload it).  How do you all normally verify that it was a exploit and not a false positive?

[mmoshiri]

Oh yes... you did say that. My mistake... so you're on the right track.

[lhayun · Accepted solution]

Adding to what Michael already mentioned, the UI provides some visibilty to the event information, but not a complete one. Upon prevention, the agent also create a memory dump of the exploited process and that dump can be retrived from the ESM (using the "retrive data" button in the security event details) and can be analyzed to  better understand the exploitation attempt. Our Support team can also assist with analyzing the event and providing next steps.

[jimmy.gonzalez]

Thanks, thats more or less what I was after.  It looks like the retrieve data creates a rule, and then I would retreive the data from the "Monitor",  "Data Retrieval"?

[lhayun]

Exactly. The data retrival create an action for the agent to send the data on the next time it connects to the ESM. Once the data is recieved by the ESM it will appear in the "Data Retrieval" screen.