A health insurer found that a PDF allowed by its Secure Firewall policy was later judged malicious by Secure Endpoint. Some branch PCs run without a Secure Endpoint agent, and the incident lead needs every host that received the file plus when its verdict changed. Which file-analysis view in FMC should the analyst open to trace the spread?
Select an answer to reveal the explanation.
Short Explanation
File trajectory follows a file by its hash, showing which hosts received it—even PCs without a Secure Endpoint agent—and how its verdict changed over time. It’s like a parcel tracker that shows where the file went and when its status changed.
Full Explanation
File trajectory follows a file by its hash, using file events recorded by the firewall. It can show hosts seen receiving the file and how its disposition changed over time, including hosts without a Secure Endpoint agent when the firewall recorded the file event. Searching connection events by hash can show transfer information, but it does not provide the file's verdict history. The Secure Endpoint console reports on endpoints covered by that product, so it does not supply visibility into agentless PCs. An intrusion-event search would not identify the spread unless an intrusion signature fired. Trajectory results depend on file-event capture and event retention, so older records may no longer be available.