Large Files in Data Retrieval

[Alex_Gomez]

Wondering if anyone can you help. In ESM --> Monitor -->  ESM --> Data Retrieval

Im seeing large files. Wondering if anyone knew why they are so large.. some are in the 634mb size..

[acc6d0b3610eec313831f7900fdbd235 · Accepted solution]

Hi @Alex_Gomez,

At the time of a security event, Traps can report the files that were accessed, modules, that were loaded into memory, URIs that were accessed, and ancestor process of the process that triggered the security event. You can define policy rules that specify what is collected; these rules can incorporate conditions, so that different users, computers, or groups receive different settings.

Traps captures the following information at the time of a security event:

• Files accessed prior to the security event;
• Modules and drivers loaded;
• URI information from web plug-ins, media players, and mail clients;
• Ancestry processes from browsers and Java applet child processes;
• You can also collect additional information about the true nature of a security event.

To modify the report collection settings, clone the policy and override the desired details. Overriding the default memory dump size rule allows to reduce the disk space consumed by dumps in the event of a prevention. However, reducing this setting to any value below the default (full) could omit important forensic information.

I hope it helps;

Willian

[Alex_Gomez]

Thanks @acc6d0b3610eec313831f7900fdbd235 for that response clears it up.

I noticed the default Policy does a Full Memory Dump, so i understand now how these files can be large.