In which two Skope IT events tables would you search to find the answers to these questions?

You are given an MD5 hash of a file suspected to be malware by your security incident response team. They ask you to offer insight into who has encountered this file and from where was the threat initiated.

In which two Skope IT events tables would you search to find the answers to these questions? (Choose two.)
A . Application Events
B . Network Events
C . Alerts
D . Page Events

View Answer

Answer: AC

Explanation:

To find the answers to the questions posed by the security incident response team, you need to search in the Application Events and Alerts tables in Skope IT. The Application Events table shows the details of the cloud application activities performed by the users, such as upload, download, share, etc. You can filter the Application Events table by the MD5 hash of the file to find out who has encountered this file and from which cloud service it was downloaded1. The Alerts table shows the details of the policy violations triggered by the users, such as DLP, threat protection, anomaly detection, etc. You can filter the Alerts table by the MD5 hash of the file to find out if this file was detected as malware by Netskope and what action was taken2. Therefore, options A and C are correct and the other options are incorrect.

Reference: Application Events – Netskope Knowledge Portal, Alerts – Netskope Knowledge Portal