Use the show events type [vm-outbound-com | vm-signature-match] command to view bot communication details and callback alerts for malicious events. For details about this command, refer to the CLI Command Reference.
To view Bot Communication Details for Email Security - Server events:
Enable the CLI enable mode.
hostname > enable
View bot communication details.
The following example shows details of the vm-outbound-comm such as when the event happened, the interface, the action, and the VM outbound analysis.
hostname # show events type vm-outbound-comm Event 6132: Occurrence Time: 2019-01-08 21:38:27 PST Interface: any Action: notified (default policy): 0 Event Type: vm-outbound-comm Analysis Type: Unknown VM Verified Outbound Communication Analysis Profile ID: 43 OS Info: Microsoft WindowsXP 32-bit 5.1 sp3 17.0108 Service C&C Services: 2 . . .
To view Callback communication observed from VM for Email Security - Server events:
Enable the CLI enable mode.
hostname > enable
View communication details for all callback communication.
The following example shows details of the vm-signature-match event type including Trace ID and C&C services.
hostname # show events type vm-signature-match Event 9432: Occurrence Time : 2019-01-09 23:04:54 PST Interface : any Action : notified (default policy): 0 Event Type : vm-signature-match Analysis Type : Unknown Trace ID : 15486 Infected IP : 0.0.0.0 C&C IP : 0.0.0.0C&C Port : 0 VLAN ID : 0 Source MAC : 00:00:00:00:00:00 Destination MAC : 00:00:00:00:00:00 C&C Services : 1 ttteco.vicp.net:6:80 [0] [fqc] GET / HTTP/1.1 User-Agent: NOKIAN95/WEB2.5 Host: ttteco.vicp.net:80 VM Malware-C&C Communication Profile ID : 86107765 Name : Trojan.APT.Naikon EDP Page URL :https://mil.fireeye.com/edp.php?sname=Trojan.APT.Naikon PCAP URL : https://172.16.172.172/event_stream/send_pcap_file?ev_id=9432 PCAP URL (TEXT) : https://172.16.172.172/event_stream/send_pcap_ascii?ev_id=9432 Event Page URL : https://172.16.172.172/event_stream/events?event_id=9432 . . .