Enabling or disabling riskware detection policy rules using the CLI

Use the CLI commands to enable or disable riskware detection policy rules on the Email Security - Server appliance.

To enable riskware detection policy rules:

Go to CLI configuration mode.

hostname > enable
hostname # configure terminal

Locate the policy rule ID you want to enable.
hostname (config) # show analysis riskware policy rules

Enable a particular policy rule ID.

hostname (config) # analysis riskware policy rule <rule_ID> enable

Save your changes.
```
hostname (config) # write memory
```
Verify the status of a policy rule for riskware detection.
```
hostname (config) # show analysis riskware policy rules
```

To disable riskware detection policy rules:

Go to CLI configuration mode.

hostname > enable
hostname # configure terminal

Locate the policy rule ID you want to disable.
hostname (config) # show analysis riskware policy rules

Disable a particular policy rule ID.

hostname (config) # no analysis riskware policy rule <rule_ID> enable

Save your changes.
```
hostname (config) # write memory
```
Verify the status of a policy rule for riskware detection.
```
hostname (config) # show analysis riskware policy rules
```

Examples

This example enables a policy rule ID for riskware detection.

hostname (config) # analysis riskware policy rule 65000 enable

This example disables a policy rule ID for riskware detection.

hostname (config) # no analysis riskware policy rule 65001 enable

This example shows the current policy rule configuration for riskware detection.

hostname (config) # show analysis riskware policy rules 
|----------|--------------------------------------------------|------------|------------|
|  Rule ID |                                             Rule | Alert Only | Quarantine |
|----------|--------------------------------------------------|------------|------------|
|    65000 | Jar Files Delivered Via Email Attachment Or Link |    Enabled |   Disabled |
|    65001 |                     Encrypted MSOffice Document  |    Enabled |   Disabled |
|    65002 |     MS Office Files With Network Activity Policy |    Enabled |   Disabled |
|    65003 |                   Executable Delivered via Email |    Enabled |   Disabled |
|    65004 |                       Script Delivered via Email |    Enabled |   Disabled |
|    65005 |     Low Confidence Custom Yara Rule Weights 0-50 |    Enabled |    Enabled |
|    65006 |  High Confidence Custom Yara Rule Weights 51-100 |    Enabled |   Disabled |
|    65007 |          MS Office Document With Embedded Object |    Enabled |   Disabled |
|    65008 |           MS Office Document With Macro Activity |    Enabled |   Disabled |
|    65009 |                   Non Executable file Connecting |            |            |
|          |                        to Non-Standard High Port |    Enabled |   Disabled |
.
.
.
|    65038 |   Supply Chain Impersonation (8.4x) |   Disabled |   Disabled |
|          |Trellix Riskware (Adware/PUP/Spam) |    Enabled |   Disabled |
|__________|__________________________________________________|____________|____________|