Skip Navigation
  1. BlackBerry Docs
  2. Cylance Endpoint Security
  3. Administration
  4. Cylance Endpoint Security Administration Guide
  5. Managing threats detected by CylancePROTECT Desktop
  6. Manage CylancePROTECT Desktop threat alerts

Manage
CylancePROTECT Desktop
 threat alerts

You can use the management console to view and manage threat alerts detected by the
CylancePROTECT Desktop
 agent. Files that are considered unsafe or abnormal display in the management console. Files that are considered safe do not display in the console.
  1. In the management console, on the menu bar, click
    Protection > Threats
    . Do any of the following:
    • To add or remove columns, click and select the columns that you want to view.
    • To group the threat alert information by one or more columns, drag those columns to the space above the column names.
    • To sort threat alerts in ascending or descending order by a column, click the column.
    • To filter the threat alerts by a column, use the filter field and icon for the column. After you filter the threat alerts, save these filters by bookmarking the page. Saving your filters as a bookmark only works for threat alerts.
  2. Do any of the following:
    Task
    Steps
    View threat alert details.
    Click on the threat alert row.
    View the threat details page.
    Click on the file name.
    Use the threat filters.
    Click a threat filter. Click the close icon to clear the threat filter.
    View threat indicators.
    Expand the
    Threat indicators
     section. For more information about threat indicators, see Threat indicators.
    Add files to a global list.
    Add files to the global quarantine or global safe list.
    1. Click the check boxes for the files to add to a global list.
    2. Click
      Global quarantine
       to add the files to the global quarantine list. Click
      Safe
       to add the files to the global safe list.
    Add a file to a local list.
    Add a file to a local quarantine or local safe list. Local lists take precedence over global lists. For example, you might want to block a file from the organization but allow it on specific devices.
    1. Click the threat alert row.
    2. On the devices list, under
      Unsafe
       or
      Abnormal
      , select the check boxes for the appropriate devices.
    3. Click
      Quarantine
       to add the file to the local quarantine list. Click
      Waive
       to add the file to the local safe list.
    Change the local list for a file.
    You can change a file from the local quarantine to the local safe list or from the local safe list to the local quarantine.
    1. Click the threat alert row.
    2. On the devices list, under
      Quarantined
       or
      Waived
      , select the check boxes for the appropriate devices.
    3. If you are on the
      Waived
       list, click
      Quarantine
       to add the file to the local quarantine list. If you are on the
      Quarantined
       list, click
      Waive
       to add the file to the local safe list.
To export the threat information to a .csv file, click Export icon. Select the scope of the export and click
Export
.