Hidden Downloads

3.4	Hidden Downloads

The Hidden Downloads report allows you to monitor all unattended downloads from user machines. An unattended download can be one of the following:

•	Valid updates started automatically from the user’s machine

•	Unwanted downloads by hidden applications

•	Interrupted / forgotten downloads initialized by the user. These are downloads that are started by the user and not saved within 15 minutes

•	Malicious downloads that will take advantage of computer software vulnerabilities using sequences of commands.

$\\fileserver\content\manuals\english\webmon2009\images\HiddenDownloads.png$

Navigate to Monitoring ► Hidden Downloads to access the Hidden Downloads view.

•	Last Time - if the URL radio button is selected, the last time when the same URL was accessed is displayed. However, if the User Agent radio button is selected then the last time when the same user agent was used is displayed.

•	Count - the number of times the hidden download was accessed

•	Real Filetype - the file type of a hidden download

•	Content Type - the content type of the hidden download as suggested from the web content-type. For more information, refer to the Adding New Content-types section in the WebSecurity Edition - File scanning and download control chapter.

•	URL - the URL of the downloaded file

•	Time - the date and time the Hidden download was accessed

•	User - the user that is being monitored and on whose machine the hidden download was launched

•	IP - the IP that is being monitored and on whose machine the hidden download was launched

•	Size - the size of the downloaded file

•	User Agent - the application/agent that launched the hidden download

From the Group By radio buttons select one of the following display options:

•	URL to show the URL of the downloaded file.

•	User Agent to display the agent that started the hidden download.

•	IP to display the IP address of the URL that started the hidden download.

From the Display radio buttons select one of the following options:

•	All to display entries for all file types.

•	Only Executables and Packages to display entries for executables and packages only.

Select the URL hyperlink to view the Permanent Whitelist dialog. For more information, refer to the Add hidden downloads to Whitelist section in this chapter.

3.4.1

Click the URL of a hidden download to launch the Permanent Whitelist dialog. Then click Add to whitelist the selected URL.