Full location of affected threat URL/filename?

[Khang_Than-Trong]

Troubleshooting what I think is a false positive but the Detailed Log View (under Threats monitoring) only shows the filename and not its full location on the HD of the machine. Is there any way to find out the full location?

[Raido_Rattameister]

Data filtering log.

Click on magnifying glass and bottom right there is url column where you can see full url.

[Khang_Than-Trong]

Thanks for the reply. Do you mean the magnifying glass that brings up the "Detailed Log View?" Its URL column only indicates "setup.exe" in this example, and not the full disk path. I wonder if that's available anywhere?

[Raido_Rattameister]

Yes

It depends on application.

Go and browse the web.

Download some pdf or doc from internet for example.

Go and find log entry for this file.

And you should see referer link there.

If not then copy ip of other side and paste it to URL filtering log.

Probably as destination. For example

( addr.dst in 194.106.121.19 )

[Khang_Than-Trong]

In this case, it is *originating* from an internal machine to another, and the only URL listed is the filename without its fixed disk location. I am guessing the filename + the originating machine is as much information as it will have since that info isn't on the network info without some sort of agent on the originating machine. I'm trying to find out where on that originating machine it is located.

[Raido_Rattameister]

So it is SMB traffic (Windows file share)?

[Khang_Than-Trong]

Yes, it's SMB traffic. Whoops forgot to mention that.

[Raido_Rattameister]

I doubt that you see UNC path anywhere.

For example you can't block traffic based on UNC path Dynamic Block Lists and UNC Server Path