Trap can be investigate or forensic anti-spyware or mallicious exploit registry

[Pattarachai]

Hi all, I would like to know Trap can be investigated or forensic anti-spyware or malicious exploit via registry? because I have an issue with a client which it seems was a delete with malware which client can't delete yourself

[wtobar]

Hi,

I'm not sure if I undertood very well, but you want to know if Traps can perform a forensic analysis, if is yes, Traps client take the events and send it to ESM, but you can create a rule on ESM  to collect forensic or files from the client.

If the issue (registry deleted) was perform when traps was enabled, you need to check your policies, first 'cause traps has the option to protect the services against malware or malintentioned actions, then second if that happend you don't have configured traps correctly.

Check Policies>Forensics, on ESM console.

The best regards,

wtobar

[Pattarachai]

@wtobarThanks for the suggestions for me, I'll try using the following information