What user or system details are collected?
The following information is collected:
-
Email address
-
Computer name
-
IP address
-
Operating system and Service Pack
-
File location
-
Information about installed Trellix products
-
Proxy settings, if system or manual proxy is set
Some users might not want to transmit samples, system data, or share their email address with our Advanced Threat Center. Those users can choose the option in the GetSusp tool to not submit results to Advanced Threat Center. Your email address enables Advanced Threat Center to communicate with you regarding the results of the scan.
Can I prevent GetSusp from sending samples or information from my computer?
GetSusp connects to Global Threat Intelligence (GTI) to match files found on your computer. If you do not want files and logs to be submitted to Advanced Threat Center, run the scan in offline mode. The files and logs harvested will not be uploaded to Advanced Threat Center. But, because there are no online lookups to the allow list database, results are degraded.
How does GetSusp complete most system scans in three to five minutes?
System scans generally take between three and five minutes. This timing is irrespective of the size of the hard disk. The scans are fast because GetSusp scans are limited to running processes, the Windows registry, and file locations used by malware.
Why does GetSusp not identify my suspected malware?
The malware must be actively running on your computer or have an associated registry startup entry for GetSusp to identify it. GetSusp identifies only suspicious executable files. GetSusp does not scan documents, scripts, media, and other file formats. We plan to add Rootkit scanning to GetSusp in a future release.
