You can view OS change event distribution in a tree view. This view shows events that resulted from a prior event nested together, and you can expand and collapse subsequent levels to reveal and hide details. All available details for malicious alerts are shown in a table, including Class, Message, and Triggered Event.
In the Web UI, click eAlerts > eAlerts > Alerts.
Select an alert. For alerts that have embedded file attachments, expand the alert and select the alert for the embedded malicious file.
Note
Duplicate alerts for files with embedded file attachments cannot be expanded.
In the left navigation bar, click the OS Change Details link for a guest image.
Click the Event Distribution tab.
At the upper right of the Event Distribution tab, select Treeview.
Expand the malicious alerts sections at the top of the view to see the most urgent information. Known malicious alert sections are titled in red.
Expand process sections and drill down into sub-process sections to follow a flow of events.
Click an OS change event type in the upper right of the expanded tree section to reveal that event in the tree.