When you detect a high-risk app instance, you can optionally respond to the risk by suspending it through the Table view.

To enter the Table view, click the Table View tab.

The Table view shows detailed information about all app instances that meet the current filter criteria.

Click on an app instance for the App Instance ID view. This view shows more information about the instance, its detected events, and the levels of risk posed by those events.

Suspending Instances

Suspending an app instance immediately terminates the instance. If a suspended instance is reopened, it is immediately terminated.

From the Table view, you can select instances using the left checkboxes and immediately suspend them using the Suspend button at the top right of the list.

To help you decide whether to suspend the instance, select an app instance from the list to see its detailed detection information. Consult the Risk Detections Quick Guide for guidance on when to suspend instances.

At the bottom right of the app instance window you can choose to suspend the app instance by clicking Suspend App Instance, or to restore the instance if it is already suspended.

The suspended instance remains visible in the instance table so you can restore it at any time, allowing it to be reopened. A restored instance retains the risk level that it had when it was suspended.