show analysis riskware policy rules

Shows the current riskware detection custom policy rule configuration.

Syntax

show analysis riskware policy rules

Parameters

None

Example

The following example shows the current riskware detection policy rule configuration on an Email Security — Server appliance running Release 8.4.1 with default settings enabled.

hostname (config) # show analysis riskware policy rules
|--------|-------------------------------------------------|------------|----------| 
| Rule ID |                                            Rule | Alert Only |Quarantine|
|---------|-------------------------------------------------|------------|----------|  
|  65000  |Jar Files Delivered Via Email Attachment Or Link |   Disabled |  Disabled| 
|  65001  |             Encrypted MS Office DocumenDisabled |   Disabled |  Disabled|   
|  65002  |PDF, HWP or MS Office Files With Network Activity|   Disabled |  Disabled|
|  65003  |Executable Delivered via Email Attachment or 
|         |                           Link within Email Body|   Disabled |  Disabled|
|  65004  |Scripst Delivered via Email                      |   Disabled |  Disabled|
|  65005  |Low Confidence Custom Yara Rule Weights 0-50     |   Disabled |  Disabled|
|  65006  |High Confidence Custom Yara Rule Weights 51-99   |   Disabled |  Disabled|
|  65007  |MS Office Document With Embedded Object          |   Disabled |  Disabled|
|  65008  |MS Office Document With Macro Activity           |   Disabled |  Disabled|
|  65009  |Non Executable file Connecting to Non-Standard 
|         |                                        High Port|   Disabled |  Disabled|
|  65010  | MS Office Document with Network Activity 
|         |                 and Embedded Object or Macro    |   Disabled |  Disabled|
|  65011  |Uncommon File Types Delivered Via Email BAT,CPL, |            |          |
|         |              LNK,COM,CMD,MHT,PIF,PUB,HLP,HTA,ISO|   Disabled |  Disabled|
|  65012  |MS Office Document With Macro Activity Dropping a|            |          |
|         |                                         exe file|   Disabled |  Disabled|
|  65013  |Password From Web Forms Found in Plaintext       |            |          |
|         |                                     Http_Request|   Disabled |  Disabled|
|  65014  |Low Confidence Custom Email Header Yara Rule     |            |          |
|         |                             Weights 0-50 Matched|   Disabled |  Disabled|
|  65015  |High Confidence Custom Email Header Yara Rule    |            |          |
|         |                            Weights 51-99 Matched|   Disabled |  Disabled|
|  65016  |Email with shortened link                        |   Disabled |  Disabled|
|  65017  |Email with MS Access DB Attached                 |   Disabled |  Disabled|
|  65020  |MS Office Document running Flash Events          |   Disabled |  Disabled|
|  65021  |MS Office Document With Password Protected Macro |   Disbaled |  Disabled|      
|  65022  |Login Page Sent as Email Attachment              |   Disabled |  Disabled|      
|  65023  |Password Protected Zip Rar Archives              |   Disabled |  Disabled|
|  65024  |Uncommon Filetype Observed .SettingContent-ms 
|                                                  Extension|   Disabled |  Disabled|
|  65025  |Suspicious File With Disagreeing Extension and 
|                                                 MagicBytes|   Disabled |  Disabled|
|  65027  |High Confidence Email Impersonation              |   Disabled |  Disabled|      
|  65028  |Low Confidence Email Impersonation               |   Disabled |  Disabled|      
|  65029  |Provided list of extensions marked for Policy
|                                                   Blocking|   Disabled |  Disabled|
|  65030  |Encrypted PDF Document                           |   Disabled |  Disabled|
|  65031  |Potential Risky ScreenSaver Indicator            |   Disabled |  Disabled|
|  65033  |HTML Redirector Sent as Email Attachment         |   Disabled |  Disabled|
|  65034  |Low Confidence Malware Guard on EX               |   Disabled |  Disabled|
|  65036  |Matchinbg Recipient and Message ID Domains       |   Disabled |  Disabled|
|  65037  |Suspicious DAA Archive Delivered via Email       |   Disabled |  Disabled|
|  65038  |Supply Chain Impersonation (8.4x)                |   Disabled |  Disabled|
|         |   FireEye Rishware (Adware/PUP/Spam             |     Enabled|   Enabled| 
|_________|_________________________________________________|____________|__________|

The following example shows the riskware detection policy rule configuration on the Email Security — Server appliance running release 8.4.0 (or earlier) when riskware detection was disabled and email was not blocked:

hostname (config) # show analysis riskware policy rules
WARNING: Riskware detection is disabled  
|-------|-----------------------------------------------------|------------|----------
|Rule ID |                                                 Rule | Alert Only |Quarantine|
|--------|------------------------------------------------------|------------|----------| 
| 65000  |     Jar Files Delivered Via Email Attachment Or Link |    Enabled | Disabled |
| 65001  |                         Encrypted MS Office Document |    Enabled | Disabled |
| 65002  |     PDF, HWP or MS Office Files With Network Activity|    Enabled | Disabled |

After the Email Security — Server appliance was upgraded to 8.4.1, the following example shows the riskware detection policy rule configuration on the appliance when riskware detection was disabled and email was not blocked before upgrade:

hostname (config) # show analysis riskware policy rules
WARNING: Riskware detection is disabled  
|-------|-----------------------------------------------------|------------|----------
|Rule ID |                                                 Rule | Alert Only |Quarantine|
|--------|------------------------------------------------------|------------|----------| 
| 65000  |     Jar Files Delivered Via Email Attachment Or Link |   Disabled | Disabled |
| 65001  |                         Encrypted MS Office Document |   Disabled | Disabled |
| 65002  |     PDF, HWP or MS Office Files With Network Activity|   Disabled | Disabled |

The following example shows the current riskware detection policy rule configuration on the Network Security appliance.

hostname (config) # show analysis riskware policy rules 
|----------|--------------------------------------------------|------------|
|  Rule ID |                                             Rule |     Status | 
|----------|--------------------------------------------------|------------|
|    65005 |     Low Confidence Custom Yara Rule Weights 0-50 |    Enabled |
|    65006 |  High Confidence Custom Yara Rule Weights 51-100 |    Disabled|
|    65009 |                   Non Executable file Connecting |            |
|          |                        to Non-Standard High Port |    Enabled |
|    65012 |         MS Office Document with Macro Activity D |    Enabled |
|__________|__________________________________________________|____________|

Output fields

Field	Description
Rule ID	A custom policy rule ID for riskware. Note The Trellix set of common riskware rules does not have an associated rule ID.
Rule	Name of the custom policy rule that is associated with the rule ID for riskware.
Alert Only	Whether the custom policy rule ID is enabled or disabled to generate a riskware alert on a non-malicious submission.This field is supported only on the Email Security — Server appliance. Note This field is supported only on the Email Security — Server appliance.
Status	Whether the custom policy rule ID is enabled or disabled to generate a riskware alert on a non-malicious submission. Note This field is supported only on the Network Security appliance.
Quarantine	Whether the custom policy rule ID is enabled or disabled to block an email from being delivered to the intended recipient. This field is supported only on the Email Security — Server appliance. Note This field is supported only on the Email Security — Server appliance.

User role

Admin

Command mode

Enable

Supported appliances

This command is supported on the following appliances running the specified releases or later:

Email Security — Server: Release 8.0. Support to enable blocking emails based on riskware detection custom policy rules was added in Release 8.0.1. The "Status" field was replaced with the "Alert Only" field in Release 8.0.2. The "Block" field was replaced with the "Quarantine" field in Release 8.0.2. The command output was enhanced to display the low and high confidence custom YARA rules in Release 8.0.2. Both rule ID 65014 and 65015 were modified to remove "Matched on Email With Attachment" from the rule name in Release 8.1.2. Both rule ID 65018 and 65019 were removed in Release 8.1.2.
In Release 8.4.2, the Trellix riskware rules and custom riskware rules were decoupled. If Trellix riskware rules were enabled globally before upgrade, the previous riskware detection configuration is preserved after the upgrade. If custom riskware rules were enabled and riskware detection was disabled, then all custom riskware rules previously enabled are disabled.
Network Security: Release 8.0