MA: Services Config View - IOC Summary Tab

Document created by RSA Information Design and Development on Sep 15, 2017Last modified by RSA Information Design and Development on Apr 11, 2019
Version 9Show Document
  • View in full screen mode
 

This topic introduces the features and functions available in the Service Config view > IOC Summary tab. This tab provides a way to view summary information for any IOC. A grid for each scoring module lists the configured IOCs along with statistics associated with that IOC of a specific range of time. The statistics include:

  • The number of events for a network session or the number of files for a static, community, or sandbox event that were flagged with the IOC.
  • The current score configured for the IOC in the Indicators of Compromise tab.
  • The scores returned by each of the scoring modules.

When you select an event, you can show the Malware Events view or Malware Files view for the IOC. You can also open the selected IOC in the Indicators of Compromise tab to edit the Current Score.

Workflow

What do you want to do?

                                                     
RoleI Want to...Show me how
AdministratorConfigure General Malware Analysis Settings Configure General Malware Analysis Settings
AdministratorConfigure Indicators of Compromise* Configure Indicators of Compromise

Administrator

Configure Auditing on Malware Analysis Host

(Optional) Configure Auditing on Malware Analysis Host

AdministratorConfigure Hash Filter(Optional) Configure Hash Filter

Administrator

Configure Installed Anti virus Vendor

Configure Installed Antivirus Vendors

AdministratorConfigure Malware Analysis Proxy Settings(Optional) Configure Malware Analysis Proxy Settings

Administrator

Register a TreadGRID API Key

(Optional) Register for a ThreatGRID API Key

AdministratorEnable Community AnalysisEnable Community Analysis

*You can perform this task in the current view

Related Topic

Basic Setup

Quick Look

This is an example of the IOC Summary tab for the Network scoring module.

                         
1Displays the IOC Summary Tab.
2Displays the Network View.
3Displays the Static View.
4Displays the Community View.
5Displays the Sandbox View.

Features

The IOC Summary consists of four tabs, one for each scoring module: Network, Static, Community, and Sandbox. Each tab has the same form and same information with a toolbar and page-able grid.

This table describes the features of each tab.

                                   
FeatureDescription
Time Range

Selects the time range for the IOC Summary. Possible values are: Last 5 Minutes, Last 15 Minutes, Last 30 Minutes, Last Hour, Last 3 Hours, Last 6 Hours, Last 12 Hours, Last 24 Hours, Last 2 Days, Last 5 Days, Early Morning, Morning, Afternoon, Evening, All Day, Yesterday, This Week, Last Week, or Custom.

Description column

Lists the descriptions for the IOCs.

Count column

Lists the number of occurrences of the IOCs. In the Network tab, the count is the number of events in which the IOC was found. In the other tabs, the count is the number of files in which the IOC was found.

Current Score column

Lists the current score for the IOCs as configured in the Indicators of Compromise tab.

Static, Network, Community, and Sandbox columns

List the scores that each of the scoring modules gave the IOCs.

Actions drop-down

The Actions drop-down menu has two options:

  • Show Events/Files: opens the IOC in the Investigation Events view or Files view. This view can also be opened by double-clicking on the IOC.
  • Edit: opens the IOC in the Indicators of Compromise tab to edit the Current Score.

You are here
Table of Contents > Malware Analysis References > Services Config View - IOC Summary Tab

Attachments

    Outcomes