Why does Elements Security Center and Elements Agent differ in this case?

Eneas

Hi, we have curious case. Elements Sec Center says a File would be detected as Trojan. We ran a local Scan with the Elements Agent and the Agent tells us, there is no risky file nor a Trojan. Why would these 2 results differ?

I double checked that its the same appliance and the same path and still i got no clue why it would differ in its response.

Hamid

Thank you for your question. This is a common scenario that can occur due to the different ways the Elements Security Center (Portal) and the Elements Agent process and report security data.

Real-Time vs. On-Demand Scanning:

The detection shown in the Elements Security Center most likely originates from a Real-Time Scanning or Web Traffic Scanning event.

-Elements Security Center (Portal):
The portal records historical events. If a file was detected and blocked or quarantined when it was first accessed or downloaded, this action is logged and remains visible in the portal.

-Local Scan (Manual Scan):
When a manual "Local Scan" is performed, the agent checks the current state of the system. If the file has already been quarantined, removed, or is no longer present, the scan will return "no risky files", as there is no active threat remaining in that location.