A file that passed inspection last week was identified as malicious by Secure Endpoint on Friday. The SOC wants the FMC to flag the original connection as malicious now and to list every host that already received the file, but the receiving laptops are unmanaged and cannot install any agent. Which Secure Endpoint integration should you configure in the FMC?

The Secure Endpoint connection configured under FMC integrations provides verdicts that arrive after a file has already been allowed. A retrospective event correlates the later verdict back to the original connection so the session, host, and time that introduced the file can be marked as malicious. File trajectory can show the file's movement across the network and list hosts observed receiving it, without endpoint software on those receivers. Reviewing only the retrospective event fails the inventory requirement, because it identifies the original connection but does not enumerate other hosts that received the file. Device trajectory in the Secure Endpoint console relies on endpoint data collected by an agent, so it does not meet the no-agent requirement. Searching last week's file inspection events fails the flagging requirement, because those records reflect the disposition at the time and do not by themselves map Friday's verdict back to the original connection. Exam caveat: menu names for this integration have changed with renames, so anchor on the capability rather than the label. Practical check: after enabling, allow a test file, confirm a retrospective event lands on the original connection, then open file trajectory and verify the observed receiver hosts are listed.