Enabling or disabling AV-Suite integration on whitelist submissions using the CLI

Use the CLI commands to enable or disable AV-Suite integration between the Email Security - Server appliance and the DTI Cloud on whitelist submissions. When static analysis and AV-Suite integration on whitelist submissions are enabled on the appliance, the submitted malware samples that are marked with the verdict "Clean" by the AV-Suite service will be included in static analysis. For details about AV-Suite, see AV-Suite on .

Note
AV-Suite integration on whitelist submissions is disabled by default.

Prerequisites

Administrator or Operator access to the Email Security - Server appliance
An established connection to the Internet
A connection to the DTI Cloud
A two-way sharing CONTENT_UPDATES license
A FIREEYE_SUPPORT license
Verify that static analysis is enabled on the appliance. Use the show static-analysis config command.
Verify that AV-Suite integration is enabled on the appliance. Use the show static-analysis config command.

To enable AV-Suite integration on whitelist submissions:

Enable the CLI configuration mode.

hostname > enable
hostname # configure terminal

Enable AV-Suite integration on whitelist submissions on the appliance.
```
hostname (config) # static-analysis av-suite whitelist enable
```
Save your changes.
```
hostname (config) # write memory
```

Verify the status of AV-Suite integration on whitelist submissions.

hostname (config) # show static-analysis

 Static Analysis enabled                   : yes
   AV-suite enabled                        : yes
   SA on AV-suite whitelist enabled       : yes
   AV-check enabled                        : yes
   Dropper enabled                         : yes
   YARA enabled                            : yes
   .....

The "SA on AV-suite whitelist enabled" line displays "yes" if AV-Suite integration on whitelist submissions is enabled.

To disable AV-Suite integration on whitelist submissions:

Enable the CLI configuration mode.

hostname > enable
hostname # configure terminal

Disable AV-Suite integration on whitelist submissions on the appliance.
```
hostname (config) # no static-analysis av-suite whitelist enable
```
Save your changes.
```
hostname (config) # write memory
```

Verify the status of AV-Suite integration on whitelist submissions.

hostname (config) # show static-analysis config

Static Analysis enabled                   : yes
  AV-suite enabled                        : yes
  SA on AV-suite whitelist enabled       : no
  AV-check enabled                        : yes
  Dropper enabled                         : yes
  YARA enabled                            : yes
  .....

The "SA on AV-suite whitelist enabled" line displays "no" if AV-Suite integration on whitelist submissions is disabled.