Collect File task

Procedure

1. After identifying the object that you want to collect, access the context or response menu and click Collect File.
   The Collect File Task screen appears.

   Note The Collect File task does not support collecting the following files: Files larger than 4 GB Protected Windows files UNC paths for file objects are not supported.

2. Specify a Description for the response or event.
3. Click Create.
   Trend Vision One creates the task and displays the current task status in Response Management.
4. Monitor the task status.
   1. Open Response Management.
   2. (Optional) Locate the task using the Search field or by selecting Collect File from the Action drop-down list.
   3. View the task status.
      • Pending approval () (if applicable): The automated response task was created on the Workbench app and is waiting for approval
      • Rejected () (if applicable): The automated response task created on the Workbench app was rejected
      • In progress (): Trend Vision One sent the command and is waiting for a response.
      • Queued (): The managing server queued the command because the agent was offline.
      • Successful (): The command was successfully executed.
      • Unsuccessful (): An error or time-out occurred when attempting to send the command to the managing server, the Security Agent is offline for more than 12 hours, or the command execution timed out.
5. Download the sample file.
   1. In the Response Management app, find the Collect File task and click the options button () at the right of the row.
   2. Click Download File.
   3. On the screen that appears, record the password for the archived sample.
   4. Click OK to download the file.

      WARNING Downloading suspicious samples may potentially harm your endpoint. Ensure that you take the necessary precautions before continuing. Trend Vision One automatically stores the collected samples in a password-protected ZIP archive. Use an external decompression program (such as 7-zip) to extract the file contents.