## Forensics report with 3rd party AV Can you please direct to a step by step guide on how to configure the Forensics report with 3rd party AV? I have reviewed the [How to configure Forensics blade to analyze an incident that was detected by external system](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk105122 "https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.SearchResultMainAction&eventSubmit_doGoviewsolutiondetails=&solutionid=sk105122") but is a bit confusing. Thanks, Charris Lappas - Tags: - [3rd party](https://community.checkpoint.com/t5/tag/3rd%20party/tg-p/board-id/endpoint-general) - [av](https://community.checkpoint.com/t5/tag/av/tg-p/board-id/endpoint-general) - [forensics](https://community.checkpoint.com/t5/tag/forensics/tg-p/board-id/endpoint-general) [1\\ \\ \\ Kudo](https://community.checkpoint.com/t5/kudos/messagepage/board-id/endpoint-general/message-id/3556/tab/all-users "Click here to see who gave kudos to this post.") [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/25608?t:ac=board-id/endpoint-general/message-id/3556/thread-id/3556&t:cp=kudos/contributions/tapletcontributionspage&ticket=q0eTs0J469uc_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/Endpoint/Forensics-report-with-3rd-party-AV/m-p/25608) - [All forum topics](https://community.checkpoint.com/t5/Endpoint/bd-p/endpoint-general/page/123 "Endpoint") - [Previous Topic](https://community.checkpoint.com/t5/Endpoint/User-Talk-with-SandBlast-Agent-Customer-South-Carolina/td-p/1296 "User Talk with SandBlast Agent Customer - South Carolina Department of Mental Health") - [Next Topic](https://community.checkpoint.com/t5/Endpoint/File-getting-error-when-download-from-google-chrome/td-p/23614 "File getting error when download from google chrome.") 3 Replies [PhoneBoy](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/7) Admin ‎2018-09-1003:10 PM [Show option menu](https://community.checkpoint.com/t5/Endpoint/Forensics-report-with-3rd-party-AV/m-p/25608# "Show option menu") - Mark as New - Bookmark - Subscribe - Mute - [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=endpoint-general&message.id=3557) - [Permalink](https://community.checkpoint.com/t5/Endpoint/Forensics-report-with-3rd-party-AV/m-p/25609/highlight/true#M3557) - [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/endpoint-general/message-id/3557/print-single-message/true/page/1) - [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/25609) The SK you linked is the tool that would be run to kick off a forensics report, with a few different methods for kicking it off. As each third party AV is different, the exact instructions will depend on the third party AV in question. The SK mentions Symantec specifically, there is another SK for Trend: [Setting up Sandblast Agent (SBA) Forensics Analysis trigger from Trend Micro Control Manager](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk112436 "https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk112436") 0 Kudos [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/25609?t:ac=board-id/endpoint-general/message-id/3556/thread-id/3556&t:cp=kudos/contributions/tapletcontributionspage&ticket=q0eTs0J469uc_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/Endpoint/Forensics-report-with-3rd-party-AV/m-p/25608) [Charris\_Lappas](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/20813) Collaborator ‎2018-09-1102:46 AM [Show option menu](https://community.checkpoint.com/t5/Endpoint/Forensics-report-with-3rd-party-AV/m-p/25608# "Show option menu") - Mark as New - Bookmark - Subscribe - Mute - [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=endpoint-general&message.id=3558) - [Permalink](https://community.checkpoint.com/t5/Endpoint/Forensics-report-with-3rd-party-AV/m-p/25610/highlight/true#M3558) - [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/endpoint-general/message-id/3558/print-single-message/true/page/1) - [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/25610) [In response to PhoneBoy](https://community.checkpoint.com/t5/Endpoint/Forensics-report-with-3rd-party-AV/m-p/25609/highlight/true#M3557) Looking it further there is another SK [SandBlast Agent Integration with Third Party Anti-Virus Vendors](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116024&partition=General&product=SandBlast "https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116024&partition=General&product=SandBlast")  so what is the difference between the two. I have followed this SK but the forensics reports are not generated. 0 Kudos [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/25610?t:ac=board-id/endpoint-general/message-id/3556/thread-id/3556&t:cp=kudos/contributions/tapletcontributionspage&ticket=q0eTs0J469uc_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/Endpoint/Forensics-report-with-3rd-party-AV/m-p/25608) [PhoneBoy](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/7) Admin ‎2018-09-1106:30 AM [Show option menu](https://community.checkpoint.com/t5/Endpoint/Forensics-report-with-3rd-party-AV/m-p/25608# "Show option menu") - Mark as New - Bookmark - Subscribe - Mute - [Subscribe to RSS Feed](https://community.checkpoint.com/rss/message?board.id=endpoint-general&message.id=3559) - [Permalink](https://community.checkpoint.com/t5/Endpoint/Forensics-report-with-3rd-party-AV/m-p/25611/highlight/true#M3559) - [Print](https://community.checkpoint.com/t5/forums/forumtopicprintpage/board-id/endpoint-general/message-id/3559/print-single-message/true/page/1) - [Report Inappropriate Content](https://community.checkpoint.com/t5/notifications/notifymoderatorpage/message-uid/25611) [In response to Charris\_Lappas](https://community.checkpoint.com/t5/Endpoint/Forensics-report-with-3rd-party-AV/m-p/25610/highlight/true#M3558) The difference is: one is reading from the Windows Event Log, another is relying on being explicitly triggered by the external tool. As was suggested in the SK, you may need to open a TAC case with the requested information for Troubleshooting. [2\\ \\ \\ Kudos](https://community.checkpoint.com/t5/kudos/messagepage/board-id/endpoint-general/message-id/3559/tab/all-users "Click here to see who gave kudos to this post.") [Click here to give kudos to this post.](https://community.checkpoint.com/t5/forums/v5/forumtopicpage.kudosbuttonv2.kudoentity:kudoentity/kudosable-gid/25611?t:ac=board-id/endpoint-general/message-id/3556/thread-id/3556&t:cp=kudos/contributions/tapletcontributionspage&ticket=q0eTs0J469uc_-1 "Click here to give kudos to this post.") 1 2 3 4 5 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0 [Reply](https://community.checkpoint.com/t5/Endpoint/Forensics-report-with-3rd-party-AV/m-p/25608) Post Reply Leaderboard Epsum factorial non deposit quid pro quo hic escorol. | User | Count | | --- | --- | |
[jorgeluiznim](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/85528) | 51 | |
[DenisQ](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/141912) | 6 | |
[WiliRGasparetto](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/96099) | 4 | |
[zaryhu](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/81287) | 3 | |
[m25487](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/21082) | 2 | |
[joesternna](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/62249) | 2 | |
[user856328](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/127455) | 1 | |
[johnrich](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/92387) | 1 | |
[StevePearson](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/58202) | 1 | |
[dunkelmorten](https://community.checkpoint.com/t5/user/viewprofilepage/user-id/86502) | 1 | [View All ≫](https://community.checkpoint.com/t5/forums/kudosleaderboardpage/board-id/endpoint-general/timerange/one_month/page/1/tab/authors) Trending Discussions [EN: Anti-Ransomware Deep Dive: Honeypots, Pre-Encryption Backup & File Rollback](https://community.checkpoint.com/t5/Endpoint/EN-Anti-Ransomware-Deep-Dive-Honeypots-Pre-Encryption-Backup-amp/td-p/279968) [Harmony Endpoint On-Premises Architecture: Components, Communication Flows & Ports](https://community.checkpoint.com/t5/Endpoint/Harmony-Endpoint-On-Premises-Architecture-Components/td-p/279803) [Arquitetura Local (On-Premises) do Harmony Endpoint: Componentes, Fluxos de Comunicação e Portas](https://community.checkpoint.com/t5/Endpoint/Arquitetura-Local-On-Premises-do-Harmony-Endpoint-Componentes/td-p/279867) Upcoming Events Sort by: - [All](https://community.checkpoint.com/t5/Endpoint/Forensics-report-with-3rd-party-AV/m-p/25608#) - [Virtual](https://community.checkpoint.com/t5/Endpoint/Forensics-report-with-3rd-party-AV/m-p/25608#) - [In-Person](https://community.checkpoint.com/t5/Endpoint/Forensics-report-with-3rd-party-AV/m-p/25608#) [Virtual](https://community.checkpoint.com/labels/Virtual) Tue 28 Jul 2026 @ 11:00 AM (EDT) [Under the Hood - Check Point and Illumio – Modern Network Defense Against AI-Based Threats](https://community.checkpoint.com/t5/CheckMates-Events/Under-the-Hood-Check-Point-and-Illumio-Modern-Network-Defense/ev-p/279701) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 12:00 PM (SGT) [The AI Security Report 2026: A Turning Point for Enterprise Defense - SGT](https://community.checkpoint.com/t5/CheckMates-Events/The-AI-Security-Report-2026-A-Turning-Point-for-Enterprise/ev-p/280019) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 02:00 PM (IDT) [The AI Security Report 2026: A Turning Point for Enterprise Defense - AMER](https://community.checkpoint.com/t5/CheckMates-Events/The-AI-Security-Report-2026-A-Turning-Point-for-Enterprise/ev-p/280021) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 03:00 PM (CEST) [The AI Security Report 2026: A Turning Point for Enterprise Defense EMEA](https://community.checkpoint.com/t5/CheckMates-Events/The-AI-Security-Report-2026-A-Turning-Point-for-Enterprise/ev-p/280020) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 11:00 AM (EDT) [TechTalk: On-Premise SD-WAN Management](https://community.checkpoint.com/t5/CheckMates-Events/TechTalk-On-Premise-SD-WAN-Management/ev-p/279370) Thu 30 Jul 2026 @ 11:30 AM (CDT) [CheckMates Live DFW: Agentic AI Security Deep Dive & Hands-On](https://community.checkpoint.com/t5/CheckMates-Events/CheckMates-Live-DFW-Agentic-AI-Security-Deep-Dive-amp-Hands-On/ev-p/279920) [Virtual](https://community.checkpoint.com/labels/Virtual) Tue 28 Jul 2026 @ 11:00 AM (EDT) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 12:00 PM (SGT) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 02:00 PM (IDT) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 03:00 PM (CEST) [Virtual](https://community.checkpoint.com/labels/Virtual) Wed 29 Jul 2026 @ 11:00 AM (EDT) [TechTalk: On-Premise SD-WAN Management](https://community.checkpoint.com/t5/CheckMates-Events/TechTalk-On-Premise-SD-WAN-Management/ev-p/279370) [Virtual](https://community.checkpoint.com/labels/Virtual) Thu 30 Jul 2026 @ 10:00 AM (PDT) [AI Security Masters E12: READY OR NOT: Securing the AI Enterprise 4/5 - AI Gateway](https://community.checkpoint.com/t5/CheckMates-Events/AI-Security-Masters-E12-READY-OR-NOT-Securing-the-AI-Enterprise/ev-p/277411) [In-Person](https://community.checkpoint.com/labels/In-Person) Tue 11 Aug 2026 @ 11:30 AM (EDT) [New York City: Agentic AI Security Deep Dive & Hands-On](https://community.checkpoint.com/t5/CheckMates-Events/New-York-City-Agentic-AI-Security-Deep-Dive-amp-Hands-On/ev-p/279476) [In-Person](https://community.checkpoint.com/labels/In-Person) Thu 13 Aug 2026 @ 11:30 AM (EDT) [Waltham, MA: Agentic AI Security Deep Dive & Hands-On](https://community.checkpoint.com/t5/CheckMates-Events/Waltham-MA-Agentic-AI-Security-Deep-Dive-amp-Hands-On/ev-p/279475) [In-Person](https://community.checkpoint.com/labels/In-Person) Thu 20 Aug 2026 @ 08:30 AM (COT) [Medellin: Workspace Evolution: Hybrid Mesh Management - Visibilidad, Automatización e IA](https://community.checkpoint.com/t5/CheckMates-Events/Medellin-Workspace-Evolution-Hybrid-Mesh-Management-Visibilidad/ev-p/280003) [In-Person](https://community.checkpoint.com/labels/In-Person) Thu 20 Aug 2026 @ 06:00 PM (COT) [Medellin: Workspace Intelligence: IA Generativa en Acción para Equipos de Seguridad](https://community.checkpoint.com/t5/CheckMates-Events/Medellin-Workspace-Intelligence-IA-Generativa-en-Acci%C3%B3n-para/ev-p/280004) [In-Person](https://community.checkpoint.com/labels/In-Person) Thu 27 Aug 2026 @ 09:00 AM (CEST) [Check Point Hands-On SASE and Cloud Workshop - Zurich](https://community.checkpoint.com/t5/CheckMates-Events/Check-Point-Hands-On-SASE-and-Cloud-Workshop-Zurich/ev-p/279914) [In-Person](https://community.checkpoint.com/labels/In-Person) Wed 21 Oct 2026 @ 09:00 AM (BST) [AI Security Workshop - Glasgow](https://community.checkpoint.com/t5/CheckMates-Events/AI-Security-Workshop-Glasgow/ev-p/278505) [CheckMates Events](https://community.checkpoint.com/t5/CheckMates-Events/eb-p/events) [Top](https://community.checkpoint.com/t5/Endpoint/Forensics-report-with-3rd-party-AV/m-p/25608) About CheckMates - [Getting Started & FAQ](https://community.checkpoint.com/t5/help/faqpage) - [Community Guidelines](https://community.checkpoint.com/t5/user/TermsOfServicePage) Learn Check Point - [Check Point for Beginners](https://community.checkpoint.com/t5/Check-Point-for-Beginners-2-0/bg-p/check-point-for-beginners-2-0) - [Check Point Trivia](https://community.checkpoint.com/t5/Check-Point-Trivia/bg-p/trivia) - [CheckFlix Videos](https://community.checkpoint.com/t5/CheckFlix/ct-p/checkflix) Advanced Learning - [Check Point Security Masters](https://community.checkpoint.com/t5/Check-Point-Security-Masters/gp-p/ccsm) - [Tip of the Week](https://community.checkpoint.com/t5/SecureKnowledge-Tip-of-the-Week/bg-p/secureknowledge) - [TechTalks](https://community.checkpoint.com/t5/TechTalks/ct-p/techtalks%20role=) - [Training and Certification](https://community.checkpoint.com/t5/Training-and-Certification/bd-p/training-and-certification) Resources - [CheckMates Toolbox](https://community.checkpoint.com/t5/CheckMates-Toolbox/ct-p/CheckMatesToolbox) - [Developers (Code Hub)](https://community.checkpoint.com/t5/Developers-API-CLI/bd-p/codehub) - [Product Announcements](https://community.checkpoint.com/t5/Product-Announcements/bg-p/products-blog) - [Upcoming Events](https://community.checkpoint.com/t5/Upcoming-Events/bg-p/checkmates-live) Non-English Discussions - [Español](https://community.checkpoint.com/t5/Espa%C3%B1ol/bd-p/spanish) - [French](https://community.checkpoint.com/t5/Fran%C3%A7ais/bd-p/francais) - [Japanese](https://community.checkpoint.com/t5/Japanese-%E6%97%A5%E6%9C%AC%E8%AA%9E/bd-p/Japanese) - [Português](https://community.checkpoint.com/t5/Portugu%C3%AAs/bd-p/portuguese) - [Russian](https://community.checkpoint.com/t5/Russian/bd-p/russian) - [Chinese](https://community.checkpoint.com/t5/Chinese/bd-p/taiwan) YOU DESERVE THE BEST SECURITY We’re Social. Follow Us [CheckMates on LinkedIn](http://linkedin.com/company/cpcheckmates) [Check Point on YouTube](https://www.youtube.com/user/CPGlobal) [CheckMates on Facebook](https://www.facebook.com/cpcheckmates/) [CheckMates on Instagram](https://www.instagram.com/cpcheckmates/) ©1994-2026 Check Point Software Technologies Ltd. All rights reserved. [Copyright](https://www.checkpoint.com/copyright/) [Privacy Policy](https://www.checkpoint.com/privacy/) [About Us](https://www.checkpoint.com/about-us/) [UserCenter](https://usercenter.checkpoint.com/) Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type. Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.