Use the CLI commands to enable or disable blocking emails based on riskware detected by Trellix Riskware rules on the Email Security - Server appliance using the CLI.
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Enable blocking emails based on riskware detected by Trellix Riskware rules on the appliance.
hostname (config) # analysis riskware policy fe-rules blockSave your changes.
hostname (config) # write memoryVerify the status of blocking emails. The FireEye Riskware (Adware/PUP/Spam) rule will have Enabled in the Quarantine column.
hostname (config) # show analysis riskware policy rules
|------------|-----------------------------------------------------------|------------|------------| | Rule ID | Rule | Alert Only | Quarantine | |------------|-----------------------------------------------------------|------------|------------| | 65000 | Jar Files Delivered Via Email Attachment Or Link | Disabled | Disabled | | 65001 | Encrypted MS Office Document | Disabled | Disabled | | 65002 | PDF, HWP or MS Office Files With Network Activity | Disabled | Disabled | . . . | 65037 | Suspicious DAA Archive Delivered via Email | Disabled | Disabled | | 65038 | Supply Chain Impersonation (8.4x) | Disabled | Disabled | | |Trellix Riskware (Adware/PUP/Spam) | Enabled | Enabled | |____________|___________________________________________________________|____________|____________|
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Disable blocking emails based on riskware detected by Trellix Riskware rules on the appliance.
hostname (config) # no analysis riskware policy fe-rules blockSave your changes.
hostname (config) # write memory