The Scan results section can display the following results:
The names of the application modules or components that generated the alert.
One or multiple categories of the detected object. For example, the name of the virus can be shown: Virus.Win32.Chiton.i.
Versions of databases of Kaspersky Anti Targeted Attack Platform modules and components that generated the alert.
Results of alert scanning by application modules and components:
YARA is the result of streaming scans of files and objects received at the Central Node. The result includes the category of the detected file in YARA rules (for example, category name susp_fake_Microsoft_signer can be displayed).
You can download a detailed log of file behavior analysis in all operating systems by clicking Download debug info.
The file is downloaded in the form of a ZIP archive encrypted with the password "infected". The name of the scanned file inside the archive is replaced by the file's MD5 hash. The file extension of file inside the archive is not displayed.
By default, the maximum hard drive space for storing file behavior scan logs is 300 GB in all operating systems. Upon reaching this limit, the application deletes the oldest file behavior scan logs and replaces them with new logs.
URL (URL Reputation) is the category of a malicious, phishing URL or an URL that has been previously used by attackers for targeted attacks on corporate IT infrastructures.
AM (Anti-Malware Engine)—Category of the detected object based on the anti-virus database. For example, the name of the virus can be shown: Virus.Win32.Chiton.i.
Click the link to display the category of the object in the Kaspersky Threats database.
Click Download to download the file to your computer's hard drive.
AA (Aggregated Alerts) means the alert was created as a result of processing aggregate and nested NDR events received by Kaspersky Anti Targeted Attack Platform from third-party systems using the NDR API methods. The events are registered using the EXT technology.
NDR: IDS (Intrusion Detection System) means the alert was created as a result of processing an NDR event resulting from a detection of anomalies in traffic that indicate an attack (for example, an NDR event for a detection of ARP spoofing indicators). Corresponds to the name of the network traffic event that caused the alert to be created.
CASB (Cloud Access Security Broker) means the alert was created as a result of detecting an employee's request to a cloud service for which monitoring is enabled.