Follow these steps to generate a high-level statistics report about email traffic using the CLI. For details about the categories for each section within the statistics report, see Sections within the statistics report.
To generate the statistics report based on one day:
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Set the time frame to one day. The following example displays partial output of the statistics report that was generated for one day.
hostname (config) # gen-emps-rpt -t 1d Start Date: 2018-01-10 00:00:00 UTC End Date: 2018-01-10 19:26:00 UTC ATTACHMENT ANALYSIS ----------------------------------------------------------------------------------- Date Tot_Email Bypass_Email Scan_Email With_att Tot_att Tot_dup Mal_att Mal_dup 2018/01/10 650530 14616 542600 67496 97297 8481 140 66 URL ANALYSIS ----------------------------------------------------------------------------------- Date Tot_Email With_URL >10_URL >100_URL >200_URL Tot_URL Mal_URL Uniq_URL(scanned) 2018/01/10 650530 517323 153819 5105 1029 6961128 88 1215269 Total emails 650530, total emails with attachments and/or urls (scanned) 574343. Total attachments from all emails is 97297, that's an average of 0.15 attachments per email. 10.00% of emails have attachment(s). Total urls from all emails is 6961128, that's an average of 10.70 urls per email. 80.00% of emails have url(s). There were 1 unique recipients and 418811 unique senders. Out of a total of 140 malicious attachments, 74 were found to be unique malicious attachments. There was a total of 81160 attachments analyzed, 8481 duplicate attachments, and 4 filetypes that are not enabled. The maximum run time was 00:05:50.239269. The maximum wait time was 00:37:28.179374. There are 49922 attachments of file type 'pdf', of which 4378 are duplicates. There are 8174 attachments of file type 'xlsx', of which 1015 are duplicates. There are 4943 attachments of file type 'xml', of which 364 are duplicates. There are 4703 attachments of file type 'xls', of which 533 are duplicates. There are 3510 attachments of file type 'docx', of which 342 are duplicates. There are 2921 attachments of file type 'zip', of which 367 are duplicates. There are 2543 attachments of file type 'vcs', of which 26 are duplicates. There are 2452 attachments of file type 'unk'. There are 2108 attachments of file type 'csv', of which 369 are duplicates. There are 2103 attachments of file type 'htm', of which 221 are duplicates. There are 1754 attachments of file type 'doc', of which 200 are duplicates. There are 1010 attachments of file type 'tnef', of which 22 are duplicates. There are 921 attachments of file type 'gz', of which 303 are duplicates. There are 530 attachments of file type 'pptx', of which 20 are duplicates. There are 474 attachments of file type 'dual', of which 77 are duplicates. ...... There are 12 attachments of file type 'xps'. ..... There are 4 attachments of file type 'com'. There are 3 attachments of file type 'cmd'. There are 2 attachments of file type 'apk'. There are 2 attachments of file type 'pub', of which 1 are duplicates. There are 1 attachments of file type 'jtd'. There are 1 attachments of file type '3gp'. Number of emails in postfix incoming queue : 0 Number of emails in postfix active queue : 0 Number of emails in postfix deferred queue : 0 ---------------------------------------------------------- Showing Attachment Analysis ---------------------------------------------------------- Total Attachments Submitted : 89627 Objects analyzed : 86887 Objects identified as Malicious : 140 - VM verified : 74 - Duplicate to VM verified : 66 - Known checksum match : 0 Total events : 3792 vm-signature-match events : 167 os-change-anomaly events : 2742 vm-outbound-comm events : 413 checksum-match events : 470 Objects break down by system status, Total : 86887 AE Analysis timeout : 0 Submitted for VM analysis : 44386 AE Submit Error : 169 Static Analysis Only : 39590 Duplicate : 18 Empty Download : 0 Submit Disabled : 180 Empty File : 76 Unknown files : 2452 Submit Whitelist : 16 ---------------------------------------------------------- Showing Url Analysis ---------------------------------------------------------- Total Url Submitted : 1963484 Objects analyzed : 20729 Objects identified as Malicious : 88 - VM verified : 88 - Duplicate to VM verified : 0 - Known checksum match : 96 Total events : 31524 vm-signature-match events : 6 os-change-anomaly events : 1561 vm-outbound-comm events : 1477 checksum-match events : 28480 Objects break down by system status, Total : 20729 Empty Download : 3938 Empty File : 0 AE Submit Error : 7 Unknown files : 7 Submit Whitelist : 0 AE Analysis timeout : 471 Submit Disabled : 429 Submitted for VM analysis : 14664 Static Analysis Only : 1161 Duplicate : 52
To generate the statistics report based on one week:
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Set the time frame to one week. The following example displays partial output of the statistics report that was generated for one week.
hostname (config) # gen-emps-rpt -t 1w Start Date: 2018-01-04 00:00:00 UTC End Date: 2018-01-10 19:29:00 UTC ATTACHMENT ANALYSIS ----------------------------------------------------------------------------------- Date Tot_Email Bypass_Email Scan_Email With_att Tot_att Tot_dup Mal_att Mal_dup 2018/01/04 739102 0 635119 71448 103353 9525 78 35 2018/01/05 691988 0 587402 71304 103541 8841 55 19 2018/01/06 312847 0 261916 19491 27399 2887 21 13 2018/01/07 286380 0 238975 16478 23863 2384 50 36 2018/01/08 725374 0 628984 73640 110593 10000 144 61 2018/01/09 845534 0 734601 84340 123657 11217 114 40 2018/01/10 652199 17090 544111 67644 97494 8504 140 66 URL ANALYSIS ----------------------------------------------------------------------------------- Date Tot_Email With_URL >10_URL >100_URL >200_URL Tot_URL Mal_URL Uniq_URL(scanned) 2018/01/04 739102 609034 186680 7395 990 8525360 130 1315673 2018/01/05 691988 559485 161852 6047 816 7537709 137 1185028 2018/01/06 312847 252914 76655 2715 365 3615351 91 508095 2018/01/07 286380 231770 69307 2668 352 3373006 100 428174 2018/01/08 725374 603386 170038 6288 860 7915853 414 1253169 2018/01/09 845534 703946 211718 6787 1019 9343337 157 1492369 2018/01/10 652199 518713 154181 5113 1029 6976464 89 1219768 Total emails 4253424, total emails with attachments and/or urls (scanned) 3741809. Total attachments from all emails is 589900, that's an average of 0.14 attachments per email. 10.00% of emails have attachment(s). Total urls from all emails is 47287080, that's an average of 11.12 urls per email. 82.00% of emails have url(s). There were 1 unique recipients and 1294085 unique senders. Out of a total of 602 malicious attachments, 332 were found to be unique malicious attachments. There was a total of 491327 attachments analyzed, 53358 duplicate attachments, and 23 filetypes that are not enabled. The maximum run time was 00:05:57.343616. The maximum wait time was 00:37:28.179374. There are 310882 attachments of file type 'pdf', of which 29424 are duplicates. There are 47615 attachments of file type 'xlsx', of which 5142 are duplicates. There are 28157 attachments of file type 'xls', of which 3373 are duplicates. There are 21947 attachments of file type 'docx', of which 1717 are duplicates. There are 18376 attachments of file type 'xml', of which 1108 are duplicates. There are 17888 attachments of file type 'unk'. There are 14836 attachments of file type 'htm', of which 1183 are duplicates. There are 14814 attachments of file type 'zip', of which 1705 are duplicates. ...... There are 496 attachments of file type 'ppt', of which 58 are duplicates. There are 294 attachments of file type 'mso', of which 37 are duplicates. There are 232 attachments of file type 'msg', of which 2 are duplicates. There are 222 attachments of file type 'cdf', of which 13 are duplicates. There are 164 attachments of file type 'jar', of which 37 are duplicates. There are 118 attachments of file type 'xps'. There are 105 attachments of file type 'mov', of which 3 are duplicates. There are 103 attachments of file type 'lzh', of which 1 are duplicates. ..... Number of emails in postfix incoming queue : 0 Number of emails in postfix active queue : 0 Number of emails in postfix deferred queue : 0 ---------------------------------------------------------- Showing Attachment Analysis ---------------------------------------------------------- Total Attachments Submitted : 544461 Objects analyzed : 527791 Objects identified as Malicious : 602 - VM verified : 332 - Duplicate to VM verified : 270 - Known checksum match : 1 Total events : 22331 vm-signature-match events : 827 os-change-anomaly events : 16669 vm-outbound-comm events : 2460 checksum-match events : 2375 Objects break down by system status, Total : 527791 AE Analysis timeout : 0 Submitted for VM analysis : 266554 AE Submit Error : 905 Static Analysis Only : 240382 Duplicate : 248 Invalid : 0 Empty Download : 0 Submit Disabled : 1322 Empty File : 422 Unknown files : 17888 Submit Whitelist : 70 ---------------------------------------------------------- Showing Url Analysis ---------------------------------------------------------- Total Url Submitted : 13154087 Objects analyzed : 127791 Objects identified as Malicious : 1118 - VM verified : 1107 - Duplicate to VM verified : 11 - Known checksum match : 1179 Total events : 136559 vm-signature-match events : 16 os-change-anomaly events : 8263 vm-outbound-comm events : 7711 checksum-match events : 120569 Objects break down by system status, Total : 127791 Empty Download : 25938 Empty File : 0 AE Submit Error : 83 Invalid : 2 Unknown files : 140 Submit Whitelist : 1 AE Analysis timeout : 518 Submit Disabled : 1848 Submitted for VM analysis : 92234 Static Analysis Only : 6261 Duplicate : 766
To generate the statistics report based on one month:
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Set the time frame to one month. The following example displays partial output of the statistics report that was generated for one month.
hostname (config) # gen-emps-rpt -t 1m Start Date: 2017-12-12 00:00:00 UTC End Date: 2018-01-10 19:42:00 UTC ATTACHMENT ANALYSIS ----------------------------------------------------------------------------------- Date Tot_Email Bypass_Email Scan_Email With_att Tot_att Tot_dup Mal_att Mal_dup 2017/12/12 859192 0 753476 85828 126710 10723 452 231 2017/12/13 835643 0 728934 83955 122431 11255 508 318 2017/12/14 859372 0 747593 82452 121802 9118 153 53 2017/12/15 757970 0 663794 75184 110131 10352 122 54 2017/12/16 332351 0 284647 19514 27358 2877 51 31 2017/12/17 319543 0 273774 18062 24746 3055 56 30 2017/12/18 784321 0 686675 80501 117666 9674 232 125 2017/12/19 844781 0 744284 84331 124518 9314 507 224 2017/12/20 804766 5569 704748 81291 119278 11318 531 318 2017/12/21 786260 4882 687700 77706 114743 10122 548 362 2017/12/22 674077 0 581985 69386 101058 10664 575 400 2017/12/23 299014 0 248015 18202 26683 3128 36 13 2017/12/24 270850 0 223092 13786 17800 2528 35 15 2017/12/25 336331 0 277322 24230 33164 4256 37 19 ...... 2018/01/07 286380 0 238975 16478 23863 2384 50 36 2018/01/08 725374 0 628984 73640 110593 10000 144 61 2018/01/09 845534 0 734601 84340 123657 11217 114 40 2018/01/10 661023 17090 551853 68515 98703 8634 141 67 URL ANALYSIS ----------------------------------------------------------------------------------- Date Tot_Email With_URL >10_URL >100_URL >200_URL Tot_URL Mal_URL Uniq_URL(scanned) 2017/12/12 859192 721763 239803 8028 1309 10588101 621 1629654 2017/12/13 835643 696303 227629 7461 1335 10070118 522 1592460 2017/12/14 859372 716740 241909 9290 1194 10660474 536 1626639 2017/12/15 757970 635521 201196 8432 1136 9367689 392 1453433 2017/12/16 332351 275321 98354 3278 375 4491363 117 621798 2017/12/17 319543 265696 93137 3676 423 4467094 125 524024 2017/12/18 784321 657676 205579 6773 1086 9216910 603 1466145 2017/12/19 844781 713846 235418 8239 1215 10400647 365 1619686 2017/12/20 804766 675186 224352 8752 1390 10085741 435 1543457 2017/12/21 786260 658197 222894 7026 1412 9662703 337 1477478 2017/12/22 674077 554557 173007 6511 1067 7919391 283 1241826 2017/12/23 299014 239169 81483 2658 438 3740561 235 519794 2017/12/24 270850 216389 74247 2848 424 3501222 184 435087 2017/12/25 336331 265524 95676 3238 548 4299675 76 517705 ..... 2018/01/07 286380 231770 69307 2668 352 3373006 100 428174 2018/01/08 725374 603386 170038 6288 860 7915853 414 1253169 2018/01/09 845534 703946 211718 6787 1019 9343337 157 1492369 2018/01/10 661023 526109 156472 5181 1036 7081367 91 1236579 Total emails 17445990, total emails with attachments and/or urls (scanned) 15367099. Total attachments from all emails is 2356357, that's an average of 0.14 attachments per email. 9.00% of emails have attachment(s). Total urls from all emails is 207975063, that's an average of 11.92 urls per email. 82.00% of emails have url(s). There were 1 unique recipients and 1309059 unique senders. Out of a total of 7013 malicious attachments, 2661 were found to be unique malicious attachments. There was a total of 1958062 attachments analyzed, 216648 duplicate attachments, and 107 filetypes that are not enabled. The maximum run time was 00:55:11.631921. The maximum wait time was 00:37:28.179374. There are 1233770 attachments of file type 'pdf', of which 110446 are duplicates. There are 189098 attachments of file type 'xlsx', of which 21450 are duplicates. There are 118704 attachments of file type 'xls', of which 15630 are duplicates. There are 85020 attachments of file type 'docx', of which 7300 are duplicates. There are 74526 attachments of file type 'xml', of which 4581 are duplicates. There are 71020 attachments of file type 'unk'. There are 63114 attachments of file type 'zip', of which 6590 are duplicates. There are 62146 attachments of file type 'htm', of which 5411 are duplicates. There are 60188 attachments of file type 'csv', of which 9896 are duplicates. There are 48029 attachments of file type 'doc', of which 7436 are duplicates. There are 38527 attachments of file type 'vcs', of which 689 are duplicates. There are 34275 attachments of file type 'gz', of which 13897 are duplicates. There are 25025 attachments of file type 'tnef', of which 1248 are duplicates. There are 14054 attachments of file type 'dual', of which 1931 are duplicates. There are 11680 attachments of file type 'pptx', of which 1381 are duplicates. There are 6494 attachments of file type 'mp3', of which 2546 are duplicates. There are 6308 attachments of file type 'wav', of which 350 are duplicates. There are 5749 attachments of file type '7zip', of which 2384 are duplicates. There are 5095 attachments of file type 'rtf', of which 512 are duplicates. ..... There are 78 attachments of file type 'avi', of which 4 are duplicates. There are 77 attachments of file type 'cmd', of which 8 are duplicates. There are 71 attachments of file type 'cab', of which 19 are duplicates. There are 28 attachments of file type 'lnk', of which 1 are duplicates. There are 21 attachments of file type 'apk', of which 2 are duplicates. There are 20 attachments of file type 'js'. ...... There are 2 attachments of file type 'flv'. There are 2 attachments of file type 'vbs'. There are 1 attachments of file type 'alz'. There are 1 attachments of file type 'chm'. There are 1 attachments of file type 'pkg'. There are 1 attachments of file type 'msi'. Number of emails in postfix incoming queue : 0 Number of emails in postfix active queue : 0 Number of emails in postfix deferred queue : 0 ---------------------------------------------------------- Showing Attachment Analysis ---------------------------------------------------------- Total Attachments Submitted : 2174250 Objects analyzed : 2113897 Objects identified as Malicious : 6955 - VM verified : 2601 - Duplicate to VM verified : 4352 - Known checksum match : 4 Total events : 108749 vm-signature-match events : 8036 os-change-anomaly events : 71840 vm-outbound-comm events : 13195 checksum-match events : 15678 Objects break down by system status, Total : 2113897 AE Analysis timeout : 0 Submitted for VM analysis : 1071384 Static Analysis Only : 961217 Duplicate : 580 Empty Download : 0 Submit Disabled : 5467 Empty File : 1390 Unknown files : 71020 Submit Whitelist : 317 Submit Create Failed : 6 AE Submit Error : 2513 Invalid : 3 ---------------------------------------------------------- Showing Url Analysis ---------------------------------------------------------- Total Url Submitted : 54779250 Objects analyzed : 481576 Objects identified as Malicious : 7866 - VM verified : 7230 - Duplicate to VM verified : 264 - Known checksum match : 7766 Total events : 519830 vm-signature-match events : 86 os-change-anomaly events : 25630 vm-outbound-comm events : 24311 checksum-match events : 469803 Objects break down by system status, Total : 481576 Empty Download : 110632 Empty File : 6 AE Submit Error : 232 Invalid : 2 Unknown files : 497 Submit Whitelist : 4 Submit Create Failed : 2 AE Analysis timeout : 1136 Submit Disabled : 7105 Submitted for VM analysis : 337541 Static Analysis Only : 22240 Duplicate : 2179
To generate the statistics report based on three months:
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Set the time frame to three months. The following example displays partial output of the statistics report that was generated for three months.
hostname (config) # gen-emps-rpt -t 3m Start Date: 2017-10-13 00:00:00 UTC End Date: 2018-01-10 19:45:00 UTC ATTACHMENT ANALYSIS ----------------------------------------------------------------------------------- Date Tot_Email Bypass_Email Scan_Email With_att Tot_att Tot_dup Mal_att Mal_dup 2017/10/13 0 0 0 0 0 0 0 0 2017/10/14 0 0 0 0 0 0 0 0 2017/10/15 0 0 0 0 0 0 0 0 2017/10/16 0 0 0 0 0 0 0 0 ..... 2017/11/29 833469 0 720219 86890 132235 12941 210 78 2017/11/30 812960 0 704303 82391 121276 11075 635 412 2017/12/01 722845 265 621772 75268 111007 10098 510 228 2017/12/02 330326 0 278386 20689 29321 2331 79 27 2017/12/03 319812 0 273017 19102 26868 2480 72 22 ...... 2017/12/30 293067 0 241935 16929 23558 2846 48 29 2017/12/31 274783 0 228482 13226 17554 2139 29 24 2018/01/01 317236 0 263581 18303 24215 2725 48 25 2018/01/02 617680 0 526669 59490 86437 7637 39 14 2018/01/03 703021 0 601265 69593 106718 9770 81 48 ..... 2018/01/08 725374 0 628984 73640 110593 10000 144 61 2018/01/09 845534 0 734601 84340 123657 11217 114 40 2018/01/10 662844 17090 553450 68685 98932 8662 141 67 URL ANALYSIS ----------------------------------------------------------------------------------- Date Tot_Email With_URL >10_URL >100_URL >200_URL Tot_URL Mal_URL Uniq_URL(scanned) 2017/10/13 0 0 0 0 0 0 0 0 2017/10/14 0 0 0 0 0 0 0 0 2017/10/15 0 0 0 0 0 0 0 0 2017/10/16 0 0 0 0 0 0 0 0 ..... 2017/11/29 833469 688846 220920 7414 1126 9679053 532 1569621 2017/11/30 812960 674367 211908 7731 1120 9499843 324 1507835 2017/12/01 722845 592679 181159 7196 1107 8382227 703 1382586 2017/12/02 330326 268583 90927 3250 515 4311616 270 606651 2017/12/03 319812 264482 89829 3580 584 4333798 209 519720 ..... 2017/12/30 293067 233685 75255 2616 426 3499586 89 485903 2017/12/31 274783 222178 73808 2555 364 3377153 141 456024 2018/01/01 317236 254948 88967 3140 495 4040672 109 525520 2018/01/02 617680 504523 149205 5123 582 6781807 277 1035970 2018/01/03 703021 576390 176568 5786 747 7830211 260 1232487 ..... 2018/01/08 725374 603386 170038 6288 860 7915853 414 1253169 2018/01/09 845534 703946 211718 6787 1019 9343337 157 1492369 2018/01/10 662844 527592 156852 5189 1038 7097564 91 1240268 Total emails 30612469, total emails with attachments and/or urls (scanned) 26933985. Total attachments from all emails is 4242512, that's an average of 0.14 attachments per email. 9.00% of emails have attachment(s). Total urls from all emails is 366548872, that's an average of 11.97 urls per email. 81.00% of emails have url(s). There were 1 unique recipients and 1341116 unique senders. Out of a total of 15022 malicious attachments, 7761 were found to be unique malicious attachments. There was a total of 3413899 attachments analyzed, 376909 duplicate attachments, and 175 filetypes that are not enabled. The maximum run time was 4 days 02:08:39.041278. The maximum wait time was 01:04:53.399876. There are 2180545 attachments of file type 'pdf', of which 200331 are duplicates. There are 328347 attachments of file type 'xlsx', of which 35901 are duplicates. There are 207207 attachments of file type 'xls', of which 27814 are duplicates. There are 154803 attachments of file type 'docx', of which 13159 are duplicates. There are 116709 attachments of file type 'xml', of which 7169 are duplicates. There are 115302 attachments of file type 'unk'. There are 110431 attachments of file type 'zip', of which 11121 are duplicates. There are 104146 attachments of file type 'htm', of which 9144 are duplicates. There are 100045 attachments of file type 'csv', of which 16189 are duplicates. There are 83472 attachments of file type 'doc', of which 11900 are duplicates. There are 70907 attachments of file type 'vcs', of which 2782 are duplicates. There are 51937 attachments of file type 'gz', of which 19940 are duplicates. There are 43451 attachments of file type 'tnef', of which 1998 are duplicates. There are 23171 attachments of file type 'dual', of which 3043 are duplicates. There are 22279 attachments of file type 'pptx', of which 2567 are duplicates. ..... There are 16 attachments of file type 'arj'. There are 10 attachments of file type 'egg'. There are 10 attachments of file type 'mpg'. There are 8 attachments of file type 'jtd'. There are 8 attachments of file type 'swf'. There are 6 attachments of file type 'dll'. ..... There are 2 attachments of file type 'midi'. There are 2 attachments of file type 'flv'. There are 2 attachments of file type 'msi'. There are 1 attachments of file type 'bat'. There are 1 attachments of file type 'chm'. There are 1 attachments of file type 'pkg'. Number of emails in postfix incoming queue : 0 Number of emails in postfix active queue : 0 Number of emails in postfix deferred queue : 0 ---------------------------------------------------------- Showing Attachment Analysis ---------------------------------------------------------- Total Attachments Submitted : 3743440 Objects analyzed : 3680264 Objects identified as Malicious : 14899 - VM verified : 7791 - Duplicate to VM verified : 7106 - Known checksum match : 72 Total events : 218527 vm-signature-match events : 16565 os-change-anomaly events : 153034 vm-outbound-comm events : 22764 checksum-match events : 26164 Objects break down by system status, Total : 3680264 AE Analysis timeout : 4781 Submitted for VM analysis : 1863871 Static Analysis Only : 1677862 Duplicate : 1153 Empty Download : 0 Submit Disabled : 9002 Empty File : 2320 Unknown files : 115284 Submit Whitelist : 625 Submit Create Failed : 259 AE Submit Error : 5079 Invalid : 28 ---------------------------------------------------------- Showing Url Analysis ---------------------------------------------------------- Total Url Submitted : 94976166 Objects analyzed : 863867 Objects identified as Malicious : 20245 - VM verified : 18981 - Duplicate to VM verified : 312 - Known checksum match : 19757 Total events : 968937 vm-signature-match events : 163 os-change-anomaly events : 45731 vm-outbound-comm events : 42914 checksum-match events : 880129 Objects break down by system status, Total : 863867 Empty Download : 190368 Empty File : 2562 AE Submit Error : 490 Invalid : 258 Unknown files : 830 Submit Whitelist : 12 Submit Create Failed : 12 AE Analysis timeout : 3385 Submit Disabled : 13209 Submitted for VM analysis : 608791 Static Analysis Only : 39758 Duplicate : 4192