Hosts Overview

Access this page from the Monitor > ATP > Hosts menu.

The hosts page lists compromised hosts and their associated threat levels. From here, you can monitor and mitigate malware detections on a per host basis.

Compromised hosts are systems for which there is a high degree of confidence that attackers have gained unauthorized access. When a host is compromised, the attacker can do several things, such as:

Send junk or spam e-mail to attack other systems or distribute illegal software.
Collect personal information, such as passwords and account numbers.

Compromised hosts are listed as security threat intelligence data feeds (also called information sources.) The data feed lists the IP address of the host along with a threat level; for example, 10.130.132.133 and threat level. 5. Once threats are identified, you can create threat prevention policies to take enforcement actions on the inbound and outbound traffic on these infected hosts. See Global Configuration for Infected Hosts for more information.

For the Hosts listed on this page, you can perform the following actions on one or multiple hosts at once:

Table 1: Operations for Multiple Infected Hosts
Action	Definition
Export Data	Click the Export button to download compromised host data to a CSV file. You are prompted to narrow the data download to a selected time-frame.
Set Policy Override	Select the check box beside one or multiple hosts and choose one of the following options: Never include host(s) in infected hosts feed Always include host(s) in infected hosts feed Use configured policy (not included in infected hosts feed)
Set Investigation Status	Select the check box beside one or multiple hosts and choose one of the following options: In progress, Resolved - false positive, Resolved - fixed, and Resolved - ignored.
NOTE: When you select a Policy Override option for hosts, other dependent status fields, such as Infected Host Feed, will also change accordingly. In some cases, you may have to refresh the page to see the updated information.

The following information is available in the Host table.

Table 2: Compromised Host Information
Field	Description
Host Identifier	The Juniper ATP Cloud-assigned name for the host. This name is created by Juniper ATP Cloud using known host information such as IP address, MAC address, user name, and host name. The assigned name will be in the following format: `username@server`. If the username is not known and MAC address or IP address are used, the name may appear as any of the following formats: `user01@2001:db8:cc:dd:ee:ff`, `user02@10.1.1.1` or `10.1.1.1` Note: You can edit this name. If you edit the Juniper ATP Cloud-assigned name, Juniper ATP Cloud will recognize the new name and not override it.
Host IP	The IP address of the compromised host.
Threat Level	A number between 0 and 10 indicating the severity of the detected threat, with 10 being the highest. Note: Click the three vertical dots at the top of the column to filter the information on the page by threat level.
Infected Host Feed	Displays the current host feed settings: Included: This is the default policy. The host is included in the infected host feed if its threat level meets the set infected host threshold. Excluded: The host is allowlisted and will be excluded from the infected host feed even if its threat level meets the threshold. Excluded Manually: The host is allowlisted manually and will be excluded from the infected host feed even if its threat level meets the threshold. Example: If you do not enable Add to Infected Hosts setting while creating a new adaptive threat profiling feed, the feed information will not be sent to the infected host feed. Included Manually: The host is blocklisted and will be included in infected host feed even if its threat level does not meet the threshold.
First Host Activity	Displays the date and time of the first activity of the threat.
Last Host Activity	Displays the date and time of the most recent activity of the threat.
C&C Hits	The number of times a command and control (C&C) server communication threat with this host was detected. Note: Click the three vertical dots at the top of the column to filter the information on the page by C&C hits.
Malware	The number of times malware was downloaded by this host. Note: Click the three vertical dots at the top of the column to filter the information on the page by malware detections.
Policy	Displays the current policy settings. Use configured policy Always include host in the Infected Hosts feed Never include host in the Infected Hosts feed
State of Investigation	Displays either Open, In progress, Resolved-False positive, Resolved-Fixed, Resolved-Ignored
Source	Displays the source of the threat. For example, API, Detection, Adaptive threat profiling feed, and so on.