Group Details

Each Job Results has one or more Groups, which will have one or more Actions. The list of the Actions in a group is collapsed by default. Information that is visible by default includes:

• Group Name and count of Actions
• Group completion status

• Actor or Actors assigned to the Group and any security technologies installed on those Actors

• User Profile or Friendly Name used for the Group (when applicable)
• The language if it is not English
• Start and end times, which may differ from the Job Submitted time
• Security Technology icons for the security technologies that detected the Job Actions in that Group
• Prevented, Detected, Alerted, and Missed overview

Alert Flags

When an alert is generated against an Action, an alert flag displays on the Job Status page, next to the Blocked / Not Blocked boxes. This indicator makes it easy to see which Action generated the alert, without having to search through all of the events.

Alert Flags on Job Status Page

You can filter the displayed Job results by result type using a drop-down list in the Job Actions area. This filter drop-down list includes the following filtering options:

• All Results (select this option for no filtering)

• Not Alerted

• Not Detected

• Not Prevented

• Prevented

• Detected

• Alerted

• Missed (this result type indicates that Job Actions were not prevented AND not detected AND not alerted AND not errored)

• Errored

When you apply these filters, the Job Actions in each group display by result type.

Results of the Not Detected filter

Results of the Alerted filter

Results of the Prevented filter

When you apply a result type filter, the following displays below each list of Actions and Groups:

An expandable menu to the right of the Group completion status lets you:

• Expand all Actions
• Collapse all Actions
• Edit Job Group notes
• Edit Job Group attachments

Job Group heading expandable menu

There's also a Show Actions option which will expand the Group to display basic Action information for each Action in the group:

• Action VID and name (can be clicked to view the Action details)

• Blocked cell that shows Blocked / Not Blocked /Alerted

  When the Action is blocked, hovering over the cell provides additional details.

  DNS Actions are marked as blocked if they timeout during Job execution.
• Events cell that indicates the detection information, which either shows 0 Events or a Count of Events
  • When there are Events, this cell can be clicked to see the event details.
  • The outline of the cell changes color based on status: blue - event timeframe is open, green - events fired, red - no events
  • While the event matching timeframe is active, hovering over the cell displays how much time remains in the event timeframe
• An Info cell, which may have icons and buttons (see Action's Info Cell for more details)

The Group level also includes an option to expand or collapse all Action details.

Jobs Group heading

Action's Info Cell

Each Action has an Info Cell. This cell is located to the right of the Action menu. contains details for the icons and buttons you may see in this cell.

Job Action Info Icons

Icon	Title	Description
	Suspicious Events	If events were logged that might match the Action but could not be 100% related. When an event cannot be matched to a Job Action, a Suspicious Event is logged.
	Debug	A magnifying glass to view the Action logs, when they are available The magnifying glass will only appear if you have enabled Show Debug Links for Jobs (option is listed in User Preferences, access by going to User > User Preferences  or if ?debug is added to the end of the job results url.
	Block page - no block rule	A clickable triangle to indicate if there was a Block HTTP page that came up and if there is a Block rule in place for that page. The triangle is yellow if no block rule, white if there is a block rule.
	Block page - block rule