Enabling or Disabling Riskware Detection Custom Policy Rules Using the CLI

Use the CLI commands in this procedure to enable or disable riskware detection custom policy rules on the Malware Analysis appliance.

To enable riskware detection custom policy rules:

  1. Go to CLI configuration mode.

    hostname > enable
hostname # configure terminal
  2. Locate the policy rule ID you want to enable.

    3. hostname (config) # show analysis riskware policy rules

  3. Enable a particular policy rule ID.

    hostname (config) # analysis riskware policy rule <rule_ID> enable
  4. Save your changes.
    5. hostname (config) # write memory

  5. Verify the status of a custom policy rule for riskware detection. 

    hostname (config) # show analysis riskware policy rules

  To disable riskware detection custom policy rules:

  1. Go to CLI configuration mode.

    hostname > enable
hostname # configure terminal
  2. Locate the policy rule ID you want to disable.

    3. hostname (config) # show analysis riskware policy rules

  3. Disable a particular policy rule ID.

    hostname (config) # no analysis riskware policy rule <rule_ID> enable
  4. Save your changes.
    5. hostname (config) # write memory

  5. Verify the status of a custom policy rule for riskware detection.

    6. hostname (config) # show analysis riskware policy rules

Examples

This example enables a custom policy rule ID for riskware detection.

hostname (config) # analysis riskware policy rule 65005 enable

This example disables a custom policy rule ID for riskware detection.

hostname (config) # no analysis riskware policy rule 65006 enable

This example shows the current custom policy rule configuration for riskware detection.

hostname (config) # show analysis riskware policy rules

|---------|------------------------------------------|------------|

| Rule ID |                                      Rule |     Status  |

|--------|------------------------------------------|------------|

|  65005  | Low Confidence Custom Yara Rule Weights 0-50|Enabled  |

| 65006  | High Confidence Custom Yara Rule Weights 51-100| Disabled  |

|  65009  |                Non Executable file Connecting to Non-St|   Enabled  |

| 65012  | MS Office Document With Macro Activity D|    Enabled  |

|________|__________________________________________|____________|