Query to show just threats detected during On-Demand scans?

[J1mX1]

I don't seem to be able to find where I can filter down to report on threat events detected specifically detected during scheduled On-Demand scans?

Within the filter 'Analyzer Detection Method' I can see the detection categories including 'On-Access' and 'On-Execute' scan types but not 'On-Demand' ? Is it just because I haven't had any threat events against 'On-Demand' scans during the time period I am investigating that the type is not listed to filter on or am I looking in the wrong place?

Any help would be appreciated!

Kind Regards,

James

[cdinet · Accepted solution]

I would suspect that is the case.  I tested in my test environment and I don't have any options (no threats detected at all), not even on access scan.  I had message pop up that said there were no methods in database, so your suspicion may be correct.  That available filter option would not be dependent on a time frame, but on whether that method returned any events.  

[ChrisQ]

Create an Events query for Threat Events with the filter as shown.

Create a second query for On-demand quick scan

[J1mX1]

Thanks both. I manually managed to trigger a detection using an artemis test file. I was then able to find the threat under 'On-Demand'. I couldn't see any before as there hadn't been any in the time frame I was looking.

I appreciate the prompt responses to help me resolve this one.