To locate and manage detected threats from the last scan, you can generate the Endpoints with Threats on Last Scan report. This report displays threats by endpoint location. From the report, you can change the endpoint's policy, run a scan, create an override for a file, or restore a file from quarantine.
You can modify the report data as follows:
- View all detected threats within a selected policy or group, which is helpful if you need to narrow search results to a specific set of endpoints.
- Drill down to see the threats detected within a date range, which is helpful if you want to narrow the search results to a specific time period.
To generate the Endpoints with Threats on Last Scan report:
- From the Endpoint Protection console, click the Reports tab.
- From the Report Type drop-down menu, select Endpoints with Threats on Last Scan.
- To include deactivated and hidden endpoints in the report, select the Include deactivated and hidden checkbox. This is an optional step.
- Click the Submit button.
The report displays in the right pane, with the following options:
- View and change the policy — To open the policy settings for that endpoint and change the settings, click the View link. Endpoints assigned to the Unmanaged policy have no View link because they are controlled at the endpoint level.
- Launch scan — Click the Broom icon on the far right to initiate a scan and auto-quarantine threats.
To view more details about threats found on an endpoint, click an item in the Hostname column. Details display in the bottom panel.
- From the bottom panel, you can perform one of the following actions on a selected threat:
- Create override — To bypass Endpoint Protection and designate the file as Good (allow the file to run) or Bad (detect and quarantine the file), from the command bar, click the Create override icon. For more information, see Applying Overrides To Files From Reports.
- Restore from Quarantine — If the file is safe, to restore it to the original location on the endpoint, from the command bar, click the Restore from Quarantine icon.
- To display or hide additional data for the report, click a column header to display the drop-down menu, then select the checkboxes to add or remove columns.