Use the CLI commands to enable or disable AV-Suite integration between the appliance and the DTI cloud.
Note
AV-suite version 6 must be configured for AV-Suite to receive suspicious object hashes through the DTI network to determine whether the object hashes have been seen before.
You can view the results of this integration only using the Web UI.
Prerequisites
Administrator or Operator access to the Email Security - Server appliance
An established connection to the Internet
A connection to the DTI Cloud
A FIREEYE_SUPPORT license
Enable the CLI configuration mode.
hostname > enable hostname # configure terminal
Enable AV-Suite integration on the appliance.
hostname (config) # static-analysis av-suite enable
Verify the status of AV-Suite integration.
hostname (config) # show static-analysis config Static Analysis enabled : yes AV-suite enabled : yes AV-suite version : 6 SA on AV-suite whitelist enabled : no AV-check enabled : yes Dropper enabled : yes YARA enabled : yes .....
Enable the CLI configuration mode.
hostname > enable hostname # configure terminal
Disable AV-Suite integration on the appliance.
hostname (config) # no static-analysis av-suite enable
Verify the status of AV-Suite integration.
hostname (config) # show static-analysis config Static Analysis enabled : yes AV-suite enabled : no AV-suite version : 6 SA on AV-suite whitelist enabled : no AV-check enabled : yes Dropper enabled : yes YARA enabled : yes .....