The Downloaded files list widget displays a list of distinct and unique files that the NSX Network Detection and Response application detected as having been downloaded by hosts in your network. This widget can only display data if the NSX Malware Prevention application is activated.

The following image shows an example of the Downloaded files list widget with data.
Image of Downloaded files list widget. Described by surrounding text.

The Quick search text box in the upper-left corner of the list provides fast, as-you-enter search capability. It filters the rows in the list and displays only those rows that have text, in any column, that matches the query string that you entered in the search text box.

To customize the columns displayed in the list, click the additional content icon. Described by surrounding text. icon located in the upper-right corner of the list.

You can customize the number of rows to be displayed. The default is 20 entries. Use the left arrowhead and right arrowhead icon icons to navigate through multiple pages.

Each row is a summary of a downloaded file. Click the plus icon icon or anywhere on an entry row to access a detailed view of the downloaded file.

The list is sorted by score and includes the following columns.
Column Name Description
MD5 The MD5 hash of the downloaded file.
Type The high-level file type of the downloaded file. Supported types are currently:
  • Archive – Archive formats such as ZIP or RAR
  • Document – Includes other types of Office documents
  • Executable – Binary application formats, such as Windows Portable Executable
  • Java – Java application or applet
  • Media – Macromedia (Adobe) Flash file
  • Other – Other recognized file format
  • PDF – Portable Document Format files
  • Script – An executable script such as JavaScript, Python, and others
  • Unknown – Unknown file type

Size in bytes of the downloaded file.


Number of times that the file was downloaded by hosts in the network.

The displayed number and icon with magnifying glass with plus sign provide a link to the detailed downloads page. The link passes an Analyst UUID filter that restricts the view to downloads of this specific file.

AV Class

A label defining the antivirus class of the downloaded file. If the label has a tag icon, you can click that icon for a description in a pop-up window.


A label defining the malware type of the downloaded file. If the label has a tag icon, you can click that icon for a description in a pop-up window.


The score assigned to the downloaded file by the analysis indicates the critical level of the detected threat and ranges from 0-100:

  • Threats that are 70 or higher are considered to be critical.
  • Threats that are between 30-69 are considered to be medium-risk.
  • Threats that are between 1-29 are considered to be benign.

For details about maliciousness core and risk estimate, see Analysis Report: Overview Tab.

If the blocked icon icon appears, it indicates the artifact has been blocked. The list is sorted by decreasing order (most critical threats at the top). Click sort-up arrow icon to sort the list in increasing order (least critical threats at the top), then click sort-down arrow icon to toggle back to the default.