Submit a threat scan request from a security incident

If your security incident has attachments, they can be easily scanned with the press of a button. For automatic threat scanning, the Threat Intelligence plugin must be activated.

Before you begin

Role required: sn_si.basic

Procedure

  1. Create a new security incident or open an existing one if you intend to attach new files to it.
  2. Click the paper clip icon in the form header and attach one or more files.
    Note: By default, the File scan type is inactive. If you want to scan a file, select Hash > Attachment to scan > Submit or click the paper clip icon in the form header and attach one or more files. If you wish to scan a file instead, see Change File scan type behavior.
  3. When you have completed your entries on the form, right-click the form header and click Save.
    After the record has been saved, a Scan attachments button appears.
  4. Click Scan attachments.
    Note:

    The work notes in the Activities related list will report the progress of the scanning process, as shown below.

    Scan result
  5. You can click the scan number at the end of the message to view the scan record. You can click the Scan reference link to view detailed scan results.