Before you can use the Audit Viewer to view the forensic data contained in a triage or data acquisition, you must process the acquisition. You can do this from the Acquisitions page or while reviewing the host alert details.
Processing an acquisition from the Acquisitions Page
Log in to the Endpoint Security (HX) Web UI.
Access the Acquisitions page by selecting Acquisitions at the top of the page.
On the Acquisitions page, select the acquisition.
Click Process Data Acquisition in the Detail pane of the Acquisitions page.
A Data Acquisition processing dialog box appears.
.png "AVProcessDataAcq.png")
Depending on the size of the acquisition file, processing may take a few minutes. You can wait for the acquisition to be processed or return to the Acquisitions page to work on other things.
If you wait for the acquisition to be processed, the Audit Viewer opens and displays the acquisition data when processing completes.
If you click Back to Acquisitions to return to the Acquisitions page, acquisition processing continues. When processing completes, the Process Data Acquisition button in the detail pane of the Acquisitions page changes to a View Data Acquisition button.
Processing an acquisition while reviewing host alert details:
Access the Hosts page by selecting Hosts at the top of the Endpoint Security (HX) Web UI.
Select the Hosts With Alerts tab.
Click on the expand icon (
.png "ExpandIcon.png")
) next to the host for which you want to review alert detail and acquisition information.In the Acquisitions section at the bottom of the host alert details page, click Process Data Acquisition for the acquisition you want to review.
A Data Acquisition processing dialog box appears.
Depending on the size of the acquisition file, processing may take a few minutes. You can wait for the acquisition to be processed or return to the host alert details to work on other things.
If you wait for the acquisition to be processed, the Audit Viewer opens and displays the acquisition data when processing completes.
If you click Back to Host Details to return to the host alert details information, acquisition processing continues. When processing completes, the Process Data Acquisition button in the detail pane of the Acquisitions page changes to a View Data Acquisition button.