Issue
The Red Canary Portal shows pending notifications on the Analytics tab and a banner on the Application page that reads An application analytic requires your review.
Environment
Red Canary Portal
Analytics
Resolution
Red Canary has published a new Potentially Unwanted Program (PUP) detector and requires input as to whether or not threats should be published if that PUP is observed executing in the future. To review new detectors, follow the steps below.
- Navigate to the link in the banner or this page
- Click the Needs Review drop-down next to a PUP detector and select one of the following
- Publishing Threats: Detections for this application are actively escalated and published as a threat.
-
Not Publishing Threats: This application is ignored. Detections don’t generate events and aren’t published as a threat.
- Note: Prevalence count will no longer increment while in this state.
- Observed Without Threats: This application generates events but they won’t be escalated and published as a threat.
- Alternatively, PUPs can be updated in bulk by checking the box in the Product Name column and assigning a new value using the Set Status button.
The Needs Review notification does not indicate Red Canary has observed the executing in the monitored environment. That figure is instead reported by the Prevalence value, which displays the number of times a PUP has been executed within the last 7 days on monitored endpoints.
Note: PUPs tagged as a High Volume Product cannot be changed from Not Publishing Threats until the prevalence count no longer exceeds Red Canary's global threshold.
Cause
As of April 2025, newly published PUP detectors are placed in Needs Review status until a preference has been chosen.
See Handling Potentially Unwanted Products for more information.