Use the show email-analysis attachment from command to view the cumulative statistics such as the total number of suspicious attachments that were submitted to the virtual machine for analysis, the total number of attachments that were detected as malicious, the total number of events that were detected, and the total number of attachments with each system status type during a specified time period.
Use the show email-analysis attachment since command to view the cumulative statistics such as the total number of suspicious attachments that were submitted to the virtual machine for analysis, the total number of attachments that were detected as malicious, the total number of events that were detected, and the total number of attachments with each system status type from a specified time up to the present.
Note
By default, the Email Security - Server appliance displays the detailed statistics for email attachments for the last 24 hours.
The output of the
show email-analysis attachment fromcommand andshow email-analysis attachment sincecommand may show a different time period from the time period that you specified. This discrepancy could be due to when data is available.The Email Security - Server appliance does not immediately update the count for each type of statistics entry for email attachments. After an email is received, there can be a delay of up to two minutes before the appliance updates the count of each entry.
Go to CLI enable mode.
hostname > enable
Specify the time period.
hostname > show email-analysis attachment from <start_date> <start_time> to <end_date> <end_time>
where:
<start_date>is specified in the format of yyyy/mm/dd.<start_time>is specified in the format of hh:mm:ss.<end_date>is specified in the format of yyyy/mm/dd.<end_time>is specified in the format of hh:mm:ss.
View the statistics for email attachments for the specified time period.
The following example displays the statistics for email attachments that have been submitted starting on 2017/11/24 and ending on 2017/12/29.
hostname > show email-analysis attachment from 2017/11/27 00:00:00 to 2017/12/29 00:00:00 Attachments Statistics: Stats Time - Start Time: 2017/12/12 16:00:00 End Time: 2017/12/29 00:00:00 Total Attachments Submitted : 4 Objects Analyzed : 5 Objects identified as Malicious : 1 - VM verified : 1 - Duplicate to VM verified : 0 - Known checksum match : 0 Total events : 11 os-change-anomaly events : 8 vm-outbound-comm events : 2 checksum-match events : 1 Objects break down by system status, Total : 5 Submitted for VM analysis : 5
Go to CLI enable mode.
hostname > enable
Specify the number of days, hours, minutes, or seconds before the present time.
To specify a number of days:
hostname > show email-analysis attachment since <number> days
where
<number>is the number of days.To specify a number of hours:
hostname > show email-analysis attachment since <number> hours
where
<number>is the number of hours.To specify a number of minutes:
hostname > show email-analysis attachment since <number> minutes
where
<number>is the number of minutes.To specify a number of seconds:
hostname > show email-analysis attachment since <number> seconds
where
<number>is the number of seconds.
View the statistics about email attachments that have been submitted for analysis from a specified time up to the present.
The following example displays the statistics for email attachments that have been submitted in the past 20 days:
hostname > show email-analysis attachment since 20 days Attachments Statistics: Stats Time - Start Time: 2017/12/29 11:00:00 End Time: 2018/01/18 11:26:52 Total Attachments Submitted : 50 Objects Analyzed : 58 Objects identified as Malicious : 28 - VM verified : 28 - Duplicate to VM verified : 0 - Known checksum match : 19 Total events : 121 vm-signature-match events : 17 os-change-anomaly events : 37 checksum-match events : 41 vm-outbound-comm events : 26 Objects break down by system status, Total : 58 Submitted for VM analysis : 50 Invalid : 8