Use the CLI show alerts hosts timeframe <start_time> <end_time> command to display the list of all triggered alerts in a specified time frame, ordered by host. Enter the start time (required) in N<h|d|m> format, where N is a number, h is hour, d is day, and m is month. For example, 24h is 24 hours. Enter the end time (optional) is in N<h|d|m> format. If you do not enter an end time the time frame will run from the start time to the present time.
Prerequisites
Administrator or Operator access to the Email Security - Server appliance
Go to the CLI enable mode.
hostname > enable
Enter the command
show alerts hosts timeframe <start_time> <end_time>:hostname # show alerts hosts timeframe <start_time> <end_time>
Examples
The following example displays the list of alerts for the past hour ordered by host.
hostname # show alerts hosts 1h SrcIP Severity #Inf #Cb #Blkd Time Last Malware ----------------------------------------------------------------------------- 10.8.138.246 minor 1 0 0 2019-01-25 10:38:55 Exploit.Kit.Malvertisement 10.11.141.50 critical 0 1 0 2019-01-25 10:14:02 Trojan.Cutwail 10.12.193.32 critical 1 5 0 2019-01-25 10:43:59 Trojan.Downloader.Bredolab 10.21.142.151 critical1 1 0 2019-01-25 10:18:27 Exploit.Kit.URL 10.37.242.92 critical 3 5 0 2019-01-25 10:22:00 Exploit.Kit.URL 10.38.197.201 minor 1 0 0 2019-01-25 11:00:40 Exploit.Kit.Redirect ...
The following example displays the list of alerts host for the day before yesterday, ordered by host.
hostname # show alerts hosts 2d 1d SrcIP Severity #Inf #Cb #Blkd Time Last Malware ----------------------------------------------------------------------------- 10.1.131.205 critical 0 2 0 2019-01-26 20:26:46 Trojan.NaviPromo 10.1.141.37 minor 1 1 0 2019-01-26 21:56:07 Trojan.Ngrbot.DNS 10.2.67.118 critical 0 1 0 2019-01-26 19:14:42 Tool.CoinMiner 10.2.70.112 minor 0 1 0 2019-01-26 20:28:39 Trojan.Ngrbot.DNS 10.2.91.111 critical 0 1 0 2019-01-26 19:58:37 Trojan.Generic 10.2.135.116 critical 0 8 0 2019-01-27 04:00:20 Virus.Virut ...