View the History of a Verdict

The verdict change history—available with ESM 4.0 and later releases—helps you to identify the flow of changes to a verdict and the source (module) of all applied verdicts. You can view the verdict change history associated with each file hash record on the
Hash Control
page.
For the ESM Console to log the verdict change, Traps must have applied the verdict to one or more agents. WildFire and Hash Control verdicts are listed in the order they are applied and Local Analysis verdicts are listed last.
  1. From the ESM Console, select
    Policies
    Malware
    Hash Control
    .
  2. Select the record for a hash. If necessary, Filter Hash Control Records to reduce the number of records the ESM Console displays.
  3. In the Previously Reported Verdicts section, review up to five of the most recent verdicts that were applied on an agent.
  4. To view details about the endpoints which have opened the file associated with the hash, select Agent List.

Recommended For You