Enabling or disabling blocking emails based on riskware detection policy rules using the CLI

Use the CLI commands to enable or disable blocking emails based on riskware detection policy rules on the Email Security - Server appliance.

To enable blocking emails based on riskware detection policy rules:

Go to CLI configuration mode.

hostname > enable
hostname # configure terminal

Locate the policy rule ID you want to enable.
hostname (config) # show analysis riskware policy rules

Enable the particular policy rule ID.

hostname (config) # analysis riskware policy rule <rule_ID> block

Save your changes.
```
hostname (config) # write memory
```

Verify the status of a policy rule to block riskware.

hostname (config) # show analysis riskware policy rules

To disable blocking emails based on riskware detection policy rules:

Go to CLI configuration mode.

hostname > enable
hostname # configure terminal

Locate the policy rule ID you want to disable.
hostname (config) # show analysis riskware policy rules

Disable a particular policy rule ID.

hostname (config) # no analysis riskware policy rule <rule_ID> block

Save your changes.
```
hostname (config) # write memory
```

Verify the status of a policy rule to block riskware.

hostname (config) # show analysis riskware policy rules

Examples

This example enables a policy rule ID to block an email based on riskware detection.

hostname (config) # analysis riskware policy rule 65000 block

This example disables a policy rule ID to not block an email based on riskware detection.

hostname (config) # no analysis riskware policy rule 65001 block

This example shows the current riskware detection policy rule configuration. Blocked rules have Enabled in the Quarantine column.

hostname (config) # show analysis riskware policy rules 
|----------|--------------------------------------------------|------------|------------|
|  Rule ID |                                             Rule | Alert Only | Quarantine |
|----------|--------------------------------------------------|------------|------------|
|    65000 | Jar Files Delivered Via Email Attachment Or Link |    Enabled |   Enabled  |
|    65001 |                     Encrypted MSOffice Document  |    Enabled |   Disabled |
|    65002 |     MS Office Files With Network Activity Policy |    Enabled |   Disabled |
|    65003 |                   Executable Delivered via Email |    Enabled |   Disabled |
|    65004 |                       Script Delivered via Email |    Enabled |   Disabled |
|    65005 |     Low Confidence Custom Yara Rule Weights 0-50 |    Enabled |    Enabled |
|    65006 |  High Confidence Custom Yara Rule Weights 51-100 |    Enabled |   Disabled |
|    65007 |          MS Office Document With Embedded Object |    Enabled |   Disabled |
|    65008 |           MS Office Document With Macro Activity |    Enabled |   Disabled |
|    65009 |                   Non Executable file Connecting |            |            |
|          |                        to Non-Standard High Port |    Enabled |   Disabled |
.
.
.
|    65038 |   Supply Chain Impersonation (8.4x) |   Disabled |   Disabled |
|          |Trellix Riskware (Adware/PUP/Spam) |    Enabled |   Disabled |
|__________|__________________________________________________|____________|____________|