"New Risk Detected" events include a hash as part of the logged information. We are firing tickets off "Single Risk Event" due to the verbosity of the alert. However Single Risk Event does not include a hash value which is something we need to help identify and contain threats. we are unable to marry New Risk Detected and Single Risk Event messages into one notification. Need SEP to log a hash of the malware found in the Single Risk Event alert notification similar to what it does for New Risk Detected.
↧