Investigation: Conduct Malware Analysis

[#1]

Analysts can use the RSA Security Analytics Malware Analysis service to detect malware.

Once you initiate a Malware Analysis investigation, there is no specific order in which to conduct the investigation. Instead, Security Analytics offers various methods of displaying the data, filtering the data, querying the data, acting on a drill point, and inspecting specific events. This topic provides information and procedures for analysts who are using the RSA Security Analytics Malware Analysis service to detect malware in selected data and files.

Analysts who conduct analyses using Security Analytics Malware Analysis need to have the appropriate system roles and permissions set up for their user accounts. See Roles and Permissions for Analysts in the Malware Analysis Configuration Guide.An administrator must configure roles and permissions.

This document groups investigation tasks according to high-level functions of an Investigation:

• Begin a Malware Analysis Investigation.
• Upload Files for Malware Analysis Scanning.
• Implement Custom YARA Content.
• Filter Dashlet Data in the Summary of Events View.
• Examine Scan Files and Events in List Form
• View Detailed Malware Analysis of an Event.

Previous Topic:Reconstruct an Event

Next Topic:Begin a Malware Analysis Investigation

You are here

Table of Contents > Conduct Malware Analysis