The Roaming Event Activity widget on the Symantec Endpoint Detection and Response Dashboard in the console provides you with a quick glance of the threat-related traffic that Symantec Web Security.cloud collects when EDR: Roaming is enabled.
For each day in a specified time period, you can view the number of traffic events that Web Security.cloud blocked or detected as malicious. You can then navigate to the Search page to view and filter these events.
To work with the Roaming widget
Do one of the following:
In the EDR cloud console, click Dashboard, and then select an appliance.
In the EDR appliance console, click Dashboard.
Under Event Activity, click Roaming.
By default, the widget displays information for the last 7 days (7d) for each activity type (Traffic, Blocked and Malicious).
To change the time period
Click one of the following date controls:
7d (last 7 days)
1m (last 30 days)
3m (last 90 days)
All (all dates)
To view the number of events for each activity type
Hover over the area chart for one of the displayed dates.
A box appears that lists the number of events for that day for each of the following activity types:
The total size (in bytes) of all the files that Web Security.cloud scanned
The number of files that Web Security.cloud blocked
The number of files that Web Security.cloud detected as malicious
Click any of the event activity types to select or deselect them from the current view.
To list the events for an activity type (blocked or malicious)
Click the activity type.
You cannot list events for Traffic.
Hover over the area chart for one of the displayed dates and then click the dot at the top of the chart.
You are directed to the search results of the Roaming: Malicious or Roaming: Blocked quick filter. This filter displays information about the events that are included in the totals for the widget.
Click the following link to learn more about using the Events Summary view.