Perform network forensics on an endpoint from the Analysis tab

You can enter an IP address and track its network behavior for a specified time period.

Go to Analysis → Network Forensics to analyze the recent behavior of the specific endpoint in the network, including conversations and events in the specified time period. The following table shows the information displayed on the Network Forensics page.

1. In the Enter IP address field, enter an IP address for which you wish to view the suspicious flows and activity. Example: 1.1.1.9.
2. Select the date and time. Use the ± time to view endpoint behavior before and after an attack.
3. Click Analyze.
4. In the top panel, view Summary for endpoint details and connections made to and from an endpoint.

   
   
   

   Item	Description
   Summary Panel
   Endpoint Summary	Analysis Window — The period of analysis. Data Source — The NTBA device that is mapped to an endpoint IP address. Note If one or more NTBAs have an endpoint IP address within the same time range, you can view these NTBA devices from this drop-down list. Zone — The zone to which this endpoint belongs to. Country — The country of the endpoint. ETF — The ETF value assigned by NTBA to an endpoint.
   Connections from endpoint	Specifies the client connections from an endpoint that include the TCP and UDP services and ports. Connections — The number of connections made from an endpoint. Applications — The applications accessed from an endpoint. Endpoint Executables — The executables accessed. TCP Services — The tcp services used by an endpoint. UDP Services — The UDP services accessed by an endpoint.
   Connections to endpoint	Connections — The number of connections made to an endpoint. Applications — The applications used on an endpoint. TCP Services — The TCP services used on an endpoint. UDP Services — The UDP services accessed on an endpoint.

5. In the lower panel, view Suspicious Flows for details like suspicious activity, applications, attack name, and files and URLs accessed.
   • From the flows, select the indicator to view specific activity-based flows. Example: Blocked executable.
   • View suspicious flows that have blocked executables involved in the attack.

   
   
   

   Item	Description
   Suspicious Flows Panel
   Suspicious activity indicators	View indicators that map to an event like an alert or attack. Destination matches attacker in another attack Source matches attacker in another attack Suspicious endpoint risk Unverified endpoint risk Executable used in another attack Suspicious executable malware confidence Blocked executable New executable URL used in another attack Suspicious URL risk Unverified URL risk File used in another attack Suspicious file malware confidence Unverified file malware confidence Attack detected New service detected
   IP Address	Specify an IP address and use Search to view flows for this address.
   Time	Displays the date and time when the suspicious flow for an event occurred. Tip You can sort the flows view based on time.
   Suspicious Activity	Displays the indicator that specifies the suspicious activity performed like an URL accessed that was involved in another attack, blocked executable accessed and others.
   Source	Specifies the source from which the flow was initiated for an endpoint. Details include endpoint and ports used.
   Destination	Specifies the destination details like endpoint involved and port.
   Applications	Displays the applications accessed from the endpoint.
   Attack	Attacks for a specific endpoint that includes attack name and result.
   File/URL Accessed	Specifies file or URL access details for a specific endpoint.

6. Click Save as CSV to export suspicious flows for analysis.