How to view logs in Xcitium Client Security (CCS)

Background Note:

You can create filtering rules for specific users in 'Advanced Settings' > 'Website Filtering'.

Background:

CCS monitors changes to registry items related to Windows Services, Autorun entries and scheduled tasks.

You can define the response CCS should take against unrecognized autoruns in 'Advanced Settings' > 'Advanced Protection' > 'Miscellaneous'.

You can also define the response to unknown autoruns found by an antivirus scan.

Action

Filter logs based on the action taken by CCS against the detected threat.

Select the filter parameter:

• Quarantine: Shows events at which the user chose to quarantine a file
• Remove: Shows events at which the user chose to delete the detected threat
• Ignore: Shows events at which the user chose to ignore the detected threat
• Detect: Shows events involving only the detection of malware
• Ask: Displays events where an alert was shown to the user so they could choose an action against a piece of detected malware
• Restore: Shows events at which quarantined applications were restored to original location by admin from Endpoint Manager
• Block: Shows events where suspicious applications were stopped
• Reverse: Shows events where VirusScope overrode potentially malicious actions
• False positive: Shows events where files flagged as threats by CCS were submitted to Xcitium by the user as a false positive.
• Add To exclusions: Shows events in which the user chose to add an item to antivirus exclusions
• Add To trusted files: Shows events in which the user changed the file rating to 'Trusted'
• Restore from Quarantine: Shows events in which files were returned to original location from quarantine
• Delete from Quarantine: Shows events in which files were removed permanently from quarantine

Enter the text or word that needs to be filtered

Enter the text in the name of the malware that needs to be filtered.

Filter the log entries based on the success or failure of the action taken against the threat by CCS.

Select the filter parameter:

• Success: Shows events in which the actions against the detected threat were successfully executed (for example, the malware was successfully quarantined)

Action

Filter logs based on the action taken by CCS against the detected threat.

Select the filter parameter:

• Quarantine: Shows events at which the user chose to quarantine a file
• Remove: Shows events at which the user chose to delete the detected threat
• Ignore: Shows events at which the user chose to ignore the detected threat
• Detect: Shows events involving only the detection of malware
• Ask: Displays events where an alert was shown to the user so they could choose an action against a piece of detected malware
• Restore: Shows events at which quarantined applications were restored to original location by admin from Endpoint Manager
• Block: Shows events where suspicious applications were stopped
• Reverse: Shows events where VirusScope overrode potentially malicious actions
• False positive: Shows events where files flagged as threats by CCS were submitted to Xcitium by the user as a false positive.
• Add To exclusions: Shows events in which the user chose to add an item to antivirus exclusions
• Add To trusted files: Shows events in which the user changed the file rating to 'Trusted'
• Restore from Quarantine: Shows events in which files were returned to original location from quarantine
• Delete from Quarantine: Shows events in which files were removed permanently from quarantine

Enter the text or word that needs to be filtered

Enter the text in the name of the malware that needs to be filtered.

Filter the log entries based on the success or failure of the action taken against the threat by CCS.

Select the filter parameter:

• Success: Shows events in which the actions against the detected threat were successfully executed (for example, the malware was successfully quarantined)

Filter logs based on events according to the response (or action taken) by the firewall.

Select the filter parameter:

• Blocked: Shows events where CCS prevented the connection
• Allowed: Shows events where the connection was allowed to proceed

Enter the text or word that needs to be filtered.

Filter logs based on events with a specific target IP address

Select 'Equal' or 'Not Equal' option from the drop-down box. 'Not Equal' will invert your selected choice.

Select 'IPv4' or 'IPv6' from the drop-down box.

Enter the IP address of the destination server or host, to filter the events that involve the connection attempts from/to that destination server or host.

Filter logs based on events that involved a specific target port number

Enter the destination port number in the text entry field

Filter logs based on events of inbound or outbound nature.

Select the filter parameter:

• In: Shows a list of events involving inbound connection attempts
• Out: Shows a list of events involving outbound connection attempts

Filter logs based on events that involved a specific protocol.

Select the filter parameter:

• TCP
• UDP
• ICMP
• IPV4
• IGMP
• GGP
• PUP
• IDP
• IPV6
• ICMPV6
• ND

Filter logs based on events that originated from a specific IP address

Select 'Equal' or 'Not Equal' option from the drop-down box. 'Not Equal' will invert your selected choice.

Enter the IP address of the source server or host, to filter the events that involve the connection attempts from/to that source server or host system.

Filter logs based on events that involved a specific source port number

Select any one of the option the drop-down:

• Equal
• Greater than
• Greater than or Equal
• Less than
• Less than or Equal

Enter the destination port number in the text entry field

Enter the search criteria for filtering the logs in the text field.

Filter logs based on events according to the response (or action taken) by HIPS

Select the filter parameter:

• Scanned online and found malicious
• Access memory
• Create process
• Terminate process
• Modify key
• Modify file
• Direct memory access
• Direct disk access
• Direct keyboard access
• Direct monitor access
• Load driver
• Send message
• Install Hook
• Access COM interface
• Execute image
• DNS/RPC client access
• Change HIPS Mode
• Shellcode injection
• Block file
• Suspicious
• Hook
• Alert Suppressed
• Scanned and found safe

Enter the search criteria for filtering the logs in the text field.

Enter the search criteria for filtering the logs in the text field.

Show events which concern files that have a specific trust-rating.

Select the filter parameter:

• None
• Unrecognized
• Trusted
• Malicious

Show events where a specific action was applied to the file by CCS

Select the restriction level(s) applied by the container to the applications, either automatically of or chosen by the user from the alert.

• Run Restricted
• Run Virtually
• Blocked
• Ignored

Show events where the file was isolated by a specific module or user

Select 'Contains' or 'Does Not Contain' option from the drop down menu. 'Does Not Contain' will invert your selected choice.

Select the source(s) by which the applications were contained.

• Containment Policy
• User
• Contained Process
• Containment Service

For example, if you choose 'Contains' and select the 'User' checkbox, then only events involving applications that were manually run inside the container are displayed.

Enter the name of the application associated with the process, that launched contained item as the search criteria for filtering the logs in the text field.

Show events created by a source process ID

Enter the process ID of the application associated, that launched contained item as the search criteria for filtering the logs in the text field.

Show events where items was contained based on its source process(es) specified by hash value(s) of executable file(s) associated with the source process(es)

Show only events that involved a specific website

Enter the website address in part or full, to filter the logs involving the website.

Show events that involved websites which are covered by a website filtering category.

Enter the website filter category name, to filter the logs involving the category

Show only events that involved a specific response by CCS

Select the action(s) to filter the logs involving those action(s).

• Allow
• Block
• Ask

Enter the type of the device in full or part as your filter criteria in the text field.

Enter the device ID of the device in full or part as your filter criteria in the text field.

Enter a Device Class ID (GUID) in part or full as your search criteria

Select the parameter to refine your search.

• Enabled

Filter entries based on the class of autorun

Choose from:

• Windows Service
• Autostart entry
• Scheduled task
• WMI Autostart entry

Filter entries based on application path

Enter the location or a part of it as your filter criteria in the text field.

Filter logs by the file or user that launched the event.

Enter the location or a part of it as your filter criteria in the text field.

Filter the events based on CCS response to the detected threat

• Ignore - CCS does not take any action
• Terminate - CCS stops the process / service
• Terminate and Disable - Auto-run processes will be stopped and the corresponding auto-run entry removed. In the case of a service, CCS disables the service.

Filter the entries based on the CCS component that discovered the threat

Select 'Equal' or 'Not Equal' from the drop down. 'Not Equal' will invert your choice

Select the specific filter parameter to refine your search.

• Autorun monitor
• Antivirus Scan

Filter the entries based on the success or failure of the action taken against the threat by CCS.

Select the specific filter parameter to refine your search.

• Success: Shows events where the actions against the detected threat were successful. For example, the malware was successfully quarantined.
• Failure: Shows events where the intended actions against the detected threat were not successful. For example, the malware was not disinfected.

Advice

Filter entries by the security recommendation in the alert.

Select 'Contains' or 'Does Not Contain' option from the drop down menu. 'Does Not Contain' inverts your choice.

Enter the text or word as your filter criteria.

For example, choose 'Contains' and enter the phrase 'you can safely allow this request' in the text field.

Answer

Filter the events based on what action the user selected at the alert.

Select 'Equal' or 'Not Equal' from the drop down. 'Not Equal' inverts your choice.

Select the parameter to refine your search.

• Unknown
• Allow
• Deny
• Treat as
• Disinfect
• Quarantine
• Quarantine and reserve
• Skip once
• Add to exclusions
• Add to trusted files
• False positive
• Skip
• Terminate
• Keep inside the Container
• Run outside the Container
• Deny and Terminate
• Deny, Terminate and Reverse
• Containment
• Visit with Secure Browser
• Run Unlimited
• Run inside the Container
• Blocked

For example, if you choose 'Equal' from the drop-down and select the 'Add to exclusions' checkbox, only the alerts where you answered 'Ignore' > 'Ignore and Add to exclusions' are displayed.

Answered

Filter logs based on the date the user answered the alerts.

Select 'Equal' or 'Not Equal' from the drop down. 'Not Equal' inverts your choice.

Enter or select the required date from the date picker

For example, if you select 'Equal' and select '07/31/2017', only alerts answered on 07/31/2017 are displayed.

Description

Filter the entries based on the description of the attempt displayed in the alert.

Select 'Contains' or 'Does Not Contain' option from the drop down menu. 'Does Not Contain' inverts your choice.

Enter the text or word as your filter criteria.

For example, if you select 'Contains' from the drop-down and enter 'connect to the internet', only the log entries of firewall alerts that contain the phrase 'connect to the internet' in the description are displayed.

Option

Filter the log entries where the user selected an additional options like 'Remember my answer', 'Submit as False Positive' from the alert.

Select 'Equal' or 'Not Equal' from the drop down. 'Not Equal' inverts your choice.

Select the specific filter parameters to refine your search.

• Remember
• Restore point
• Submit
• Trusted publisher

For example, if you choose 'Equal' from the drop-down and select 'Remember' from the checkbox options, only the log entries of alerts for which 'Remember my answer' option was selected are displayed.

Treat as

Filter events where the user chose specific actions on the alert. For example, 'treat as a safe application', 'treat as an installer' and so on.

Select 'Contains' or 'Does Not Contain' option from the drop down menu. 'Does Not Contain' inverts your choice.

Enter the text or word as your filter criteria

For example, if you have chosen 'Contains' from the drop-down and entered 'Installer' in the text field, only the log entries containing the phrase 'Installer' in the 'Treat As' column are displayed.

Alert Type

Filter the log entries based on the CCS component that triggered the alert

Select 'Equal' or 'Not Equal' from the drop down. 'Not Equal' inverts your choice.

Select the specific filter parameters to refine your search.

• Antivirus Alert
• Firewall Alert
• HIPS alert
• Containment alert
• VirusScope Alert
• Network alert

For example, if you select 'Equal' from the drop-down and select 'Antivirus Alert' checkbox, only the log of antivirus alerts are displayed.

Code

Filter the entries based on specified error code

Select 'Equal' or 'Not Equal' from the drop down. 'Not Equal' inverts your choice.

Enter the code or a part of it as your filter criteria in the text field.

For example, if you have select 'Equal' and entered '0x80004004' in the text field, then only entries containing the value '0x80004004' in the 'Code' column are displayed.

Completed

Filter events based on tasks successfully finished on the specified date

Select 'Equal' or 'Not Equal' from the drop down. 'Not Equal' inverts your choice.

Enter or select the required date from the date picker

For example, if you choose 'Equal' and select '08/01/2019', only the logs of tasks completed on 08/01/2019' are displayed.

Parameter

Filter the entries based on the specified parameter. A 'parameter' is a sub-type of the main task type. For example, 'Quick Scan' and 'Rating Scan' are both parameters of the main task type 'Antivirus Scan'.

Select 'Contains' or 'Does Not Contain' option from the drop down menu. 'Does Not Contain' inverts your choice.

Enter the text or word as your filter criteria.

For example, if you choose 'Contains' option from the drop-down and enter the phrase 'Quick Scan' in the text field, then only the entries of 'Antivirus Scan Tasks' with the scan parameter 'Quick Scan' are displayed.

Type

Filter the entries based on the CCS tasks category.

Select 'Equal' or 'Not Equal' from the drop down. 'Not Equal'  inverts your choice.

Select the specific filter parameters to refine your search.

• Antivirus update
• Antivirus scan
• Log Clearing
• Product upgrade
• Binary update
• File Rating DB Upgrade
• Purge file list
• Virtual Desktop Session
• Reset the Container
• DLP Discovery Scan

Location

Filter the entries based on the file path whose trust rating was changed

Select 'Contains' or 'Does Not Contain' option from the drop down menu. 'Does Not Contain' inverts your choice.

Enter the location or a part of it as your filter criteria in the text field.

For example if you have chosen 'Contains' and entered 'C:/Program Files (x86)/Cuckoo Files/Cuckoo.exe in the text field, then only log entries with the same value in the 'Path' column are displayed.

Modifier

Filter events based on who changed the file rating

Select 'Equal' or 'Not Equal' from the drop down. 'Not Equal' inverts your choice.

Select the filter parameter to refine your search

• Administrator
• User
• Xcitium

For example, if you select 'Equal' from the drop-down and select 'User' checkbox, only logs of changes done by the users are displayed.

Action

Filter the entries based on the file activity

Select 'Equal' or 'Not Equal' from the drop down. 'Not Equal'  inverts your choice.

Select the filter parameter to refine your search

• Added
• Changed
• Removed

For example, if you select 'Equal' from the drop-down and select 'Removed' checkbox, only the logs of files that were removed from the file list are displayed.

Rating Source

Filter the entries by who provided the file rating

Select 'Contains' or 'Does Not Contain' option from the drop down menu. 'Does Not Contain' inverts your choice.

Ratings can be provided by:

• Administrator
• Administrator (by Vendor)
• User
• User (by Vendor)
• AV database
• Trusted installer
• FLS
• FLS (by Vendor)
• Valkyrie
• SmartScreen
• Signed by Xcitium
• Signed by Microsoft

For example, if you select 'Equal' from the drop-down and select 'User' checkbox, only the logs of files that were rated by the users are displayed.

Old Rating

Filter the entries based on trust rating of files before the change

Select 'Contains' or 'Does Not Contain' option from the drop down menu. 'Does Not Contain' inverts your choice.

Select the filter parameter to refine your search

• Unrecognized
• Trusted
• Malicious

For example, if you select 'Contains' from the drop-down and select 'Unrecognized' checkbox, only the logs of files that are rated as 'Unrecognized' in the 'Old Rating' column are displayed.

New Rating

Filter logs by the trust rating of files after the change

Select 'Contains' or 'Does Not Contain' option from the drop down menu. 'Does Not Contain' inverts your choice.

Select the filter parameter to refine your search

• Unrecognized
• Trusted
• Malicious

For example, if you select 'Contains' from the drop-down and select 'Malicious' checkbox, only the logs of files that are rated as 'Malicious' in the 'New Rating' column are displayed.

File Hash

Filter logs by hash value

Select 'Equal' or 'Not Equal' from the drop down. 'Not Equal' inverts your choice.

• Enter the SHA1 hash value of the file in the text field to refine your search

Vendor

Filter logs by the software publisher name whose trust rating was changed

Select 'Contains' or 'Does Not Contain' option from the drop down menu. 'Does Not Contain' inverts your choice.

Type the name of the vendor in full or part in the text field.

For example if you choose 'Contains' and enter 'Digital' in the text field, only those log entries related to the vendors who has contain 'Digital' as a part in their name are displayed.

Modifier

Filter logs by who changed the vendor rating

Select 'Equal' or 'Not Equal' from the drop down. 'Not Equal'  inverts your choice.

Select the filter parameter to refine your search

• Administrator
• User
• Xcitium

For example, if you select 'Equal' from the drop-down and select 'User' checkbox, only logs of changes done by the users are displayed.

Action

Filter logs by the type of change made to the vendor list.

Select 'Equal' or 'Not Equal' from the drop down. 'Not Equal' inverts your choice.

Possible actions:

• Added
• Changed
• Removed

For example, if you select 'Equal' from the drop-down and select 'Removed' checkbox, only the logs of vendors that were removed from the vendor list are displayed.

Property

Filter logs by the entity that  provided the vendor rating

Select 'Contains' or 'Does Not Contain' option from the drop down menu. 'Does Not Contain' inverts your choice.

Entities that can provide trust ratings:

• Administrator Rating
• User Rating
• Xcitium Rating

For example, if you select 'Equal' from the drop-down and select 'User Rating' checkbox, only the logs of vendors that were rated by users are displayed.

Old Rating

Filter logs by the trust rating of the vendor before the change

Select 'Contains' or 'Does Not Contain' option from the drop down menu. 'Does Not Contain' inverts your choice.

Select the filter parameter to refine your search

• Unrecognized
• Trusted
• Malicious

For example, if you select 'Contains' from the drop-down and select 'Unrecognized' checkbox, only the logs of vendors that are rated as 'Unrecognized' in the 'Old Rating' column are displayed.

New Rating

Filter logs by the vendor's trust rating after the change.

Select 'Contains' or 'Does Not Contain' option from the drop down menu. 'Does Not Contain' inverts your choice.

Possible new trust ratings are:

• Unrecognized
• Trusted
• Malicious

For example, if you select 'Contains' from the drop-down and select 'Malicious' checkbox, only the logs of vendors that are rated as 'Malicious' in the 'New Rating' column are displayed.

Action

Filter logs by the type of change that was made. For example, rule modified, file exclusion created.

Select 'Equal' or 'Not Equal' from the drop down. 'Not Equal' inverts your choice.

Options are:

• Added
• Changed
• Removed
• Option changed

Modifier

Filter events based on who changed the configuration such as the user, administrator and response given to an alert

Select 'Equal' or 'Not Equal' from the drop down. 'Not Equal' inverts your choice.

The possible modifiers are:

• User
• Auto learn
• Antivirus Alert
• Firewall Alert
• HIPS alert
• Containment alert
• Scheduler
• Xcitium
• Administrator

For example, if you select 'Equal' from the drop-down and select 'User' checkbox, only logs of changes done by the users are displayed.

Name

Filter the entries based on object label that was affected by the configuration change, for example, Shared Spaces, Windows Management and so on

Select 'Contains' or 'Does Not Contain' option from the drop down menu. 'Does Not Contain' inverts your choice.

Enter the object name as filter criteria in the text box.

For example, if you choose 'Contains' then enter the phrase 'surfer.exe' in the text field, then you will only see logs with surfer.exe in the name column.

Component

Filter logs by the object modified by the action.

Select 'Equal' or 'Not Equal' from the drop down. 'Not Equal' inverts your choice.

Select the affected object.

It is not possible to list all possible objects in this table. Please consult the list in the search interface.

Action

Filter logs by the type of virtual desktop activity.

Select 'Equal' or 'Not Equal' from the drop down. 'Not Equal' inverts your choice.

Possible activities:

• Virtual Desktop Launched
• Virtual Desktop Terminated
• Session Started
• Session Paused
• Session Continued
• Session Terminated
• Switched to Windows View
• Switched to Virtual Desktop

For example, if you select 'Equal' from the drop-down and select 'Session Started' checkbox, only the session initiated events are displayed in the 'Action' column.

Status

Filter logs by whether the event was was successful or not. Examples include paused sessions successfully resumed, wrong PIN entered and user could not resume a paused session.

Select 'Equal' or 'Not Equal' from the drop down. 'Not Equal' inverts your choice.

Possible outcomes are:

• Success
• Failure
• Expired

Target

Filter entries by document location and / or storage device.

Select 'Contains' or 'Does Not Contain' option from the drop down menu. 'Does Not Contain' inverts your choice.

Enter the location, or a part of it, as your filter criteria.

Rule

Filter entries by rule name

Select 'Contains' or 'Does Not Contain' option from the drop down menu. 'Does Not Contain' inverts your choice.

Enter the DLP rule name, or a part of it, as your filter criteria.

Action

Filter entries by the action taken on the target. The action may be:

1) An action CCS took on target a file.

2) An action that a user took on the target file.

3) An action CCS took on an external device.

• Ignore - CCS did not take any action on the file. You are, of course, free to review and assess the file.
• Quarantine - CCS moved the files to quarantine
• Restore from Quarantine  - The file was moved back to its original location by the user
• Delete from Quarantine - The file was removed from the system by the user
• Blocked - CCS implemented 'Read-only' mode on an external device, preventing users from copying potentially sensitive files to it.

Status

Filter logs by whether the event was was successful or not.

Select 'Equal' or 'Not Equal' from the drop down. 'Not Equal' inverts your choice.

Possible outcomes are:

• Success
• Failure