> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/active-threats.md). # Active Threats The active threats overview gives you a detailed overview of all detected Advanced Persistent Threats (APT) that are active. {% hint style="danger" %} **Please note**: To show values here, you must enable the **Advanced Persistent Threats** option in the [settings of the individual hosts](/docs/manual/english/platform-usage/host-detail-view/settings.md#core-feature) or under **Hosts** → **Policies** via a [corresponding policy](/docs/manual/english/platform-usage/hosts/management/policy-manager/add-policy-manager.md#advanced-persistent-threats). {% endhint %} *** Navigate to **Hosts** → **Advanced Persistent Threats** → **Active Threats** to show a timeline and a list of all detected active threats.

The [active threats overview](#active-threats-overview) provides information such as: * in which file path and on which host an APT with a specific severity was detected. * which plans contain the rule that detected the corresponding APT. * exactly when the APT was detected. You can also define a [start and end time](#define-start-and-end-time) for the view and [add detected APTs to the whitelist](#add-whitelist-entry). *** ## Navigation Click the **Text Search** field above the list and enter a search term of your choice to find specific list items more quickly. Click the **Refresh** icon above the list to update all list items. Scroll down the list or adjust the number of results shown per page ![](https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FfjKACCt2SKXcFd3S7Xb5%2FEnginsight-EN-Results%20per%20Page.jpg?alt=media\&token=e1650160-7a41-4965-aaca-6975db758dbe) to view additional entries. Use the page navigation ![](https://content.gitbook.com/content/V7OrHgKXA0t1jankQBYf/blobs/wnxVw06QGoSsYjhwMJRF/Enginsight-Seitennavigation-2.jpg) to switch between pages. ### Defining Start and End Time Click **Start Time** or **End Time** in the upper-right corner to define the start or end of the period to be analyzed. The date picker opens. {% tabs %} {% tab title="Relative Time Period" %} Define a **Relative Time Period** manually. You can also select a relative time range from one of the available **Templates**.

Click the field with the default setting **Days Ago** to expand a list of all available time ranges. Select a time range. In the number field, enter the number of seconds, minutes, hours, days, or weeks you want to show. The default value is **1**. Click **Apply** to confirm your settings. {% endtab %} {% tab title="Absolute Time Period" %} Select a date from the calendar view.

Optionally, click **Time** to set an exact time in the 24-hour format using the clock face. First, select an hour. The clock face then switches to the minute view. Select the required minutes. Click **Apply** to confirm your settings. {% endtab %} {% endtabs %} Click **Reset** in the upper-right corner to reset the settings for the selected time range. ### Filtering the List Click the **Filter** icon above the list to filter the list by predefined parameters.

Available Filters

Parameter	Type	Description
Host	String	Filter by a specific host on which an APT was detected, or exclude it from the results. All available hosts are shown.
Plan	String	Filter by a specific plan to which the rule that detected the APT is assigned, or exclude it from the results. All available plans are shown.
Rule	String	Filter by a specific rule that detected the APT, or exclude it from the results. All available rules are shown.
Severity	String	Filter by a specific severity assigned to an APT, or exclude it from the results. All available severity levels are shown.

### Sorting List Items Click the **Sort** icon next to a column name in the table header to sort by that column in ascending or descending order . Click the sort icon above the list to adjust the priority of the applied sorting. A menu opens that shows all columns by which the list is currently sorted. Drag and drop the shown items to change the sorting priority. *** ## Active Threats: Timeline The active threats timeline shows a bar chart with the number of all detected APTs over the selected period.

Hover over a bar in the chart to show the aggregated number of registered APT detections at a specific point in time. *** ## Active Threats: Overview The active threats overview is structured as a table.

The following information is shown:

Column	Description
Severity	Shows the severity of the detected APT. The following severity levels can be shown: Critical: The APT has very high criticality. High: The APT has high criticality. Medium: The APT has medium criticality. Low: The APT has low criticality.
Location	Shows the file path that contains the APT. The date and time of the first and last detection are also shown. Click a file path to navigate to the respective detail view for the detected active threat.
Rule	Shows the rule that detected the APT. Click the name of a rule to navigate to the respective edit view.
Plan	Shows the plan or plans that contain the rule that detected the APT. Click the name of a plan to navigate to the respective edit view.
Host	Shows the name of the host on which the APT was found. Click the name of a host to navigate to the respective host detail view.
Detected on	Shows the date and time when the APT was detected.
Actions	Add the detected APT to the whitelist. Click Add whitelist. A new window opens where you can directly create a new whitelist entry.

*** ## Active Threat: Detail View Click a file path in the **Location** column to navigate to the corresponding [detail view for the active threat](/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/active-threats/active-threats-detail-view.md). *** ## Adding a Whitelist Entry Click **Add Whitelist** at the end of a list element to open a new window where you can directly create a new whitelist entry for the detected APT.

Click **Add Whitelist** after you configured all settings to save and create the new whitelist entry. Click **Back** to return to the overview. {% hint style="danger" %} **Please note**: If you leave this view without clicking **Add Whitelist**, all configured settings are permanently lost! {% endhint %} ### General Settings

Option	Description
Name	Enter a meaningful name for the whitelist entry.
Description	Provide a more detailed description for the whitelist entry. This field is optional.

### Assigned Hosts Define the hosts for which the whitelist entry should apply. {% hint style="info" %} This field is already prefilled with the host on which the selected APT was detected. {% endhint %} Click the **Hosts** field to expand a list of all available hosts, and select one or more hosts. Alternatively, use free-text input to find hosts in the list more quickly.\ \ Click the **Remove** icon next to an added host to remove it from the **Hosts** field. ### File Paths Define file paths to which the whitelist entry should apply.

Option	Description
File Path	Enter a file path. This field is already prefilled with the file path in which the selected APT was detected. You can also use wildcards (*) here.
Add Field	Click Add Field to add the file path to the whitelist entry and show another field for specifying an additional file path.
Delete	Click the Delete icon next to an added file path to remove the respective path from the rule set.

***