Viewing Infected Devices
Quantum Spark 1500, 1600 and 1800 Appliance Series R80.20.40 Locally Managed Administration Guide | 205
To filter the infected devices list:
1. Click
Filter
.
2. Select one of the filter options:
n
Servers only
- Shows only machines that were identified as servers (and not any
machine/device).
Servers are defined as server objects in the system from the
Access Policy
>
Servers
page.
n
Possibly infected only
- Shows only devices or servers classified as possibly infected.
n
Infected only
- Shows only devices or servers classified as infected.
n
High and above severity only
- Shows devices and servers that are infected or possibly
infected with malwares that have a severity classification of high or critical.
To add a malware exception rule for a specified protection:
1. Select the list entry that contains the protection for which to create an exception.
2. Click
Add Protection Exception
.
3. Click the links in the rule summary or the table cells to select network objects or options that fill out the
exception rule fields.
n
Scope
- Select either
Any
or a specific scope from the list. If necessary, you can create a
New
network object, network object group, or local user.
If it is necessary to negate a specified scope, select the scope and select the
Any Scope
except
checkbox.
For example, if the scope of the exception should include all scopes
except
for the DMZ
network, select DMZ network and select the
Any Scope
except checkbox.
Note - DMZ is not supported in 1530 / 1550 appliances.
n
Action
- Select the applicable action to enforce on the matching traffic:
Ask
,
Prevent
,
Detect
or
Inactive
.
See the
Threat Prevention
>
Threat Prevention Blade Control
page for a description of the
action types.
n
Log
- Select the tracking option:
None
,
Log
, or
Alert
.
Logs are shown on the
Logs & Monitoring
>
Security Logs
page.
An alert is a flag on a log. You can use it to filter logs.
4. Optional - Add a comment in the
Write a comment
field.
5. Click
Apply
.
The rule is added to
Malware Exceptions
on the
Threat Prevention
>
Exceptions
page.
