What is the default scan range in Trend Micro Attack Scanner for Splunk? How do I change it?

[masato_wang]

What is the default scan range? How do I change it?

[TrendMicro_Splu · Accepted solution]

By default, Attack Scanner only scans events with timestamps within the past seven days. This can be changed by modifying the values associated with the parameters Start time for C&C Callback Scan and End time for C&C Callback Scan on the app Set Up screen. For example, to extend the scan period to cover the past 10 days, specify -10d@d for Start time for C&C Callback Scan.