> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/active-threats/active-threats-detail-view.md). # Active Threats: Detail View Click a list entry to view detailed information about the respective Advanced Persistent Threat (APT).

## General Information/Detected APTs This section summarizes all information from the [active threats overview](/docs/manual/english/platform-usage/hosts/advanced-persistent-threats/active-threats.md#active-threats-overview) again.

### Hashes For informational purposes, this section shows the respective checksums of the directory in which the APT was detected according to Secure Hash Algorithm 256 (SHA-256), Secure Hash Algorithm 1 (SHA-1), and Message-Digest Algorithm 5 (MD5). ### Permissions This section shows which permissions individual roles have for the directory in which the APT was detected. The following roles are shown:

Role	Description
Owner	The owner of the directory.
Group	The user group that has access to the directory.
Other	Other roles that have access to the directory.

The following permissions are shown in ascending order of criticality:

Permission	Description
Read	The role has read permissions.
Write	The role has write permissions.
Execute	The role has permission to execute files.

### Owner This section shows which users (**User**) and user groups (**Group**) are the owners (**Owner**) of the directory and therefore have the respective [permissions](#permissions). *** ## Applicable Rule This section shows the display name of the rule and the corresponding YARA rule through which the APT was detected.

*** ## Adding a Whitelist Entry Click **Add Whitelist** in the upper right corner to open a new window where you can directly create a new whitelist entry for the detected APT.

Click **Add Whitelist** after you configured all settings to save and create the new whitelist entry. Click **Back** to return to the overview. {% hint style="danger" %} **Please note**: If you leave this view without clicking **Add Whitelist**, all configured settings are permanently lost! {% endhint %} ### General Settings

Option	Description
Name	Enter a meaningful name for the whitelist entry.
Description	Provide a more detailed description for the whitelist entry. This field is optional.

### Assigned Hosts Define the hosts for which the whitelist entry should apply. {% hint style="info" %} This field is already prefilled with the host on which the selected APT was detected. {% endhint %} Click the **Hosts** field to expand a list of all available hosts, and select one or more hosts. Alternatively, use free-text input to find hosts in the list more quickly.\ \ Click the **Remove** icon next to an added host to remove it from the **Hosts** field. ### File Paths Define file paths to which the whitelist entry should apply.

Option	Description
File Path	Enter a file path. This field is already prefilled with the file path in which the selected APT was detected. You can also use wildcards (*) here.
Add Field	Click Add Field to add the file path to the whitelist entry and show another field for specifying an additional file path.
Delete	Click the Delete icon next to an added file path to remove the respective path from the rule set.

***