Proxy Storyboard

elopezsa edited this page Sep 21, 2016 · 1 revision

###Walk-through

  1. Select the option Proxy > Storyboard from Open Network Insight Menu.

  1. Your view should look something like this, depending on how many threats you have analyzed and commented on the Threat Analysis for that day. You can select a different date from the calendar.

Executive Threat Briefing

Data source file: threats.csv
Executive Threat Briefing frame lists all the incident titles you entered at the Threat Investigation notebook. You can click on any title and view the additional comments at the bottom area of the panel.

Incident progression

Data source file: incident-progression-{id}.json
Incident progression frame is located on the right side of the Web page.
Incident Progression displays a tree graph (dendrogram) detailing the type of connections that conform the activity related to the threat. It presents the following fields:

  • Referer – URLs that refers to the Suspicious Proxy Record
  • IP – All ip addresses connecting to the Suspicious Proxy Record
  • Method – Proxy methods used to communicate in between the IP addresses and the Proxy Record
  • ContentType – HTTP MIME Types
  • Threat – Represents the Suspicious Proxy Record
  • Referred – URLs that the Suspicious Proxy Record referred to

If multiple IP Addresses connects to a particular Proxy Threat (URL) you can scroll down/up, arrows indicate that there are more elements in the list.

Timeline

Data source file: timeline-{id}.tsv
Timeline is created using the connections found during the Threat Investigation process. It will display 'clusters' of IP connections to the Proxy Record (URL), grouped by time; showing an overall idea of the times during the day with the most activity. You can zoom in or out into the graphs timeline using your mouse scroll. The number next to the IP Address represents the quantity of connections made from that particular IP to the Proxy Record in the displayed time.

Input files

threats.csv   
incident-progression-{id}.json
timeline-{id}.tsv 
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.
Press h to open a hovercard with more details.