Knowledge Base

Basic details about the MetaDefender NDR signatures can be accessed by clicking Knowledge Base. The signature names, event id, category, confidence, and severity of each signature are listed. You can use page navigation to scroll across the Knowledge Base pages.

To search for an MetaDefender NDR signature or specific information contained in signature rules (such as metadata), you can use the Quick Search feature on the left pane as required. Results matching your search, including the text inside the signature details, are displayed.

Note: For information on using this feature, refer the Quick Search section in the Session Analysis section.

Click View in the Actions column to view the details of each signature. These details include:

• Severity and confidence of the signature, signature name, author of the signature (OPSWAT), version and revision information of the signature based on the number of times it was updated.
• Signature name followed by its brief description, signature type, and reference URLs of the file type.
• Sessions triggered by the signature with their basic details.
• A brief overview of the signature on the right pane.

Click RetroHunt corresponding to a policy to run a RetroHunt Events.

Manual RetroHunt scans can also be run from the Knowledge Base Details page by clicking RetroHunt under the Rescan RetroHunt Events section on the right side of the page.