To view statistics about a scan, use the show fmps scan-id command in standard mode. This command displays details about a specific scan and its results. For more information, see the File Protect User Guide.
Syntax
show fmps scan-idscanID
Parameters
scanID
The scan identification number.
Examples
Completed Scan Results
The following example displays the results of a completed scan. This is the format for instant ("now") scans and continuous scans that are completed, running, or aborted.
hostname > show fmps scan-id 1 Scan ID: 1 (State: Completed Description: Scan completed) Scan type: Now Passive Scan: Disabled Dynamic Analysis Enabled list: rtf url exe doc docx ppt pptx xlsx png dll docm jar eml pdf ico vcf com com1 htm ppsx gif jpg jpeg tiff swf mov qt mp3 mp4 asf rm chm hlp pps vbs 3gp bat cmd wav avi wma mpg midi rmi lnk xml flv fdf xdp js wsf vcs csv msi jtd hta pkg mpkg mach-o app dmg dylib url-applet mht mhtml xps applet xll ps1 eeml elf acrobatsecuritysettings pub one accdb php jsp sct gen settingcontent-ms xsl war reg raw32 raw64 inf asp aspx ashx contact msp class csproj cs webm xspf tt xoml zul mof cna scpt resx dxf bmp cfm vm onetoc2 jse pothtml ppthtml pptxml sldm sldx thmx pptm ppsm potx odp otp Dynamic Analysis Disabled list: xls Scan name: HRScan Share name: Acme_HR Share URL: //10.14.40.30/IX1 Filetype whitelist: 7zip asf cdf Selected filetypes: com exe ppt Quarantine repository name: local_QF Good repository name: Acme-good Unknown repository name: Acme-Unknown Whitelisted repository name: Acme-Whitelist Only files modified: after 2014-01-01 08:09:00 Advanced: Timestamp type: change Rescan: false Started at: 2014-10-08 15:10:38 Ended at: 2014-10-08 15:15:03 Duration: 00:04:25.073049 Total number of files in the share: 533 (Scannable 533) Scanned: 533 (2.0 files/sec => ~173778 files/day) Analyzed: 2 (~0.4% of the share) Good: 0 (~0.0% of the share) Unknown: 526 (~98.7% of the share) Whitelisted: 5 (~0.9% of the share) Duplicates: 0 (~0.0% of the share) Malicious: 2 (~0.4% of the share) -------------------------------------------------------------------- Filetypes Statistics -------------------------------------------------------------------- File type Analyzed Malicious Good Sec per analysis Duplicates Duplicate percentage Whitelisted Whitelisted percentage exe 2 2 0 163 0 0.0 1 33.3 zip 0 0 0 0 0 0.0
4 100.0
Configured scan results
The following example displays the results of a scan that is configured but has not yet run.
hostname > show fmps scan-id 231 Scan ID: 231 (State: Configured Description: Scan configured) Scan type: Now Passive Scan: Disabled Dynamic Analysis Enabled list: rtf url exe doc docx ppt pptx xlsx png dll docm jar eml pdf ico vcf com com1 htm ppsx gif jpg jpeg tiff swf mov qt mp3 mp4 asf rm chm hlp pps vbs 3gp bat cmd wav avi wma mpg midi rmi lnk xml flv fdf xdp js wsf vcs csv msi jtd hta pkg mpkg mach-o app dmg dylib url-applet mht mhtml xps applet xll ps1 eeml elf acrobatsecuritysettings pub one accdb php jsp sct gen settingcontent-ms xsl war reg raw32 raw64 inf asp aspx ashx contact msp class csproj cs webm xspf tt xoml zul mof cna scpt resx dxf bmp cfm vm onetoc2 jse pothtml ppthtml pptxml sldm sldx thmx pptm ppsm potx odp otp Dynamic Analysis Disabled list: xls Scan name: HRScan Share name: Acme_HR Share URL: //10.14.40.30/IX1 Filetype whitelist: xls Selected filetypes: com exe ppt pdf Quarantine repository name: local_QF Good repository name: Acme-good Unknown repository name: Acme-Unknown Whitelisted repository name: Acme-Whitelist Only files modified: - Subdirectories: Employees Advanced: Timestamp type: change Rescan: false
Prescan results
The following example displays the results of a completed prescan.
hostname > show fmps scan-id 93 Scan ID: 93 (State: Completed Description: Scan completed) Scan type: Prescan Passive Scan: Disabled Dynamic Analysis Enabled list: rtf url exe doc docx ppt pptx xlsx png dll docm jar eml pdf ico vcf com com1 htm ppsx gif jpg jpeg tiff swf mov qt mp3 mp4 asf rm chm hlp pps vbs 3gp bat cmd wav avi wma mpg midi rmi lnk xml flv fdf xdp js wsf vcs csv msi jtd hta pkg mpkg mach-o app dmg dylib url-applet mht mhtml xps applet xll ps1 eeml elf acrobatsecuritysettings pub one accdb php jsp sct gen settingcontent-ms xsl war reg raw32 raw64 inf asp aspx ashx contact msp class csproj cs webm xspf tt xoml zul mof cna scpt resx dxf bmp cfm vm onetoc2 jse pothtml ppthtml pptxml sldm sldx thmx pptm ppsm potx odp otp Dynamic Analysis Disabled list: xls Scan name: HRPre Share name: Acme_HR Share URL: //10.14.40.30/IX1 Filetype whitelist: - Selected filetypes: - Quarantine repository name: - Good repository name: - Unknown repository name: - Whitelisted repository name: - Only files modified: - Advanced: Timestamp type: change Rescan: false Started at: 2014-10-09 14:26:22 Ended at: 2014-10-09 14:26:29 Duration: 00:00:07.505747 Total number of files in the share: 10 (Scannable 10) Scanned: 10 (1.4 files/sec => ~123429 files/day) Analyzable: 5 (~50.0% of the share) Whitelisted: 0 (~0.0% of the share) Skipped: 5 (~50.0% of the share) ------------------------------------------------------ Filetypes Statistics ------------------------------------------------------ File type Analyzable Sec per analysis Whitelisted Whitelisted percentage doc 1 0 0 0.0 docx 1 0 0 0.0 pdf 3 0 0 0.0
Scheduled scan results
The following example displays the results of a scan that is scheduled but has not yet run.
hostname > show fmps scan-id 68 Scan ID: 68 (State: Scheduled Description: Scan scheduled) Scan type: - Schedule parameters: Status: active Type: weekly Day: Sunday Time: 05:00 Scans from schedule: - Passive Scan: Disabled Dynamic Analysis Enabled list: rtf url exe doc docx ppt pptx xlsx png dll docm jar eml pdf ico vcf com com1 htm ppsx gif jpg jpeg tiff swf mov qt mp3 mp4 asf rm chm hlp pps vbs 3gp bat cmd wav avi wma mpg midi rmi lnk xml flv fdf xdp js wsf vcs csv msi jtd hta pkg mpkg mach-o app dmg dylib url-applet mht mhtml xps applet xll ps1 eeml elf acrobatsecuritysettings pub one accdb php jsp sct gen settingcontent-ms xsl war reg raw32 raw64 inf asp aspx ashx contact msp class csproj cs webm xspf tt xoml zul mof cna scpt resx dxf bmp cfm vm onetoc2 jse pothtml ppthtml pptxml sldm sldx thmx pptm ppsm potx odp otp Dynamic Analysis Disabled list: xls Scan name: HRWeekly Share name: Acme_HR Share URL: //10.14.40.30/IX1 Filetype whitelist: avi Selected filetypes: doc pdf ppt Quarantine repository name: Acme-quar Good repository name: - Unknown repository name: - Whitelisted repository name: - Only files modified: - Advanced: Timestamp type: change Rescan: false
Completed scheduled scan results
The following example displays the results of a scheduled scan that was completed. (The schedule parameters are not included in these results.)
hostname > show fmps scan-id 84 Scan ID: 84 (State: Completed Description: Scan completed) Passive Scan: Disabled Dynamic Analysis Enabled list: rtf url exe doc docx ppt pptx xlsx png dll docm jar eml pdf ico vcf com com1 htm ppsx gif jpg jpeg tiff swf mov qt mp3 mp4 asf rm chm hlp pps vbs 3gp bat cmd wav avi wma mpg midi rmi lnk xml flv fdf xdp js wsf vcs csv msi jtd hta pkg mpkg mach-o app dmg dylib url-applet mht mhtml xps applet xll ps1 eeml elf acrobatsecuritysettings pub one accdb php jsp sct gen settingcontent-ms xsl war reg raw32 raw64 inf asp aspx ashx contact msp class csproj cs webm xspf tt xoml zul mof cna scpt resx dxf bmp cfm vm onetoc2 jse pothtml ppthtml pptxml sldm sldx thmx pptm ppsm potx odp otp Dynamic Analysis Disabled list: xls Scan type: Scheduled Schedule parameters: Schedule ID: 83 Scan name: HRWeekly Share name: Acme_HR Share URL: //10.14.40.30/IX1 Filetype whitelist: - Selected filetypes: - Quarantine repository name: - Good repository name: - Unknown repository name: - Whitelisted repository name: - Only files modified: - Advanced: Timestamp type: change Rescan: false Started at: 2014-10-08 00:31:20 Ended at: 2014-10-08 00:32:07 Duration: 00:00:47.543062 Total number of files in the share: 10 (Scannable 10) Scanned: 10 (0.2 files/sec => ~18383 files/day) Analyzed: 1 (~10.0% of the share) Good: 3 (~30.0% of the share) Unknown: 5 (~50.0% of the share) Whitelisted: 0 (~0.0% of the share) Duplicates: 4 (~40.0% of the share) Malicious: 2 (~20.0% of the share) -------------------------------------------------------------------- Filetypes Statistics -------------------------------------------------------------------- File type Analyzed Malicious Good Sec per analysis Duplicates Duplicate percentage Whitelisted Whitelisted percentage doc 0 0 1 0 1 100.0 0 0.0 docx 0 0 1 0 1 100.0 0 0.0 pdf 1 2 1 73 2 66.7 0 0.0
Deleted scheduled scan
The following example displays the results of a scheduled scan that was deleted.
hostname > show fmps scan-id 14 Scan ID: 14 (State: Scheduled Description: Scan scheduled) Scan type: - Schedule parameters: Status: retired Type: weekly Day: Sunday Time: 05:00 Scans from schedule: - Passive Scan: Disabled Dynamic Analysis Enabled list: rtf url exe doc docx ppt pptx xlsx png dll docm jar eml pdf ico vcf com com1 htm ppsx gif jpg jpeg tiff swf mov qt mp3 mp4 asf rm chm hlp pps vbs 3gp bat cmd wav avi wma mpg midi rmi lnk xml flv fdf xdp js wsf vcs csv msi jtd hta pkg mpkg mach-o app dmg dylib url-applet mht mhtml xps applet xll ps1 eeml elf acrobatsecuritysettings pub one accdb php jsp sct gen settingcontent-ms xsl war reg raw32 raw64 inf asp aspx ashx contact msp class csproj cs webm xspf tt xoml zul mof cna scpt resx dxf bmp cfm vm onetoc2 jse pothtml ppthtml pptxml sldm sldx thmx pptm ppsm potx odp otp Dynamic Analysis Disabled list: xls Scan name: ITWeekly Share name: Acme_IT Share URL: //10.14.40.30/IX2 Filetype whitelist: avi Selected filetypes: doc pdf ppt Quarantine repository name: Acme-quar Good repository name: - Unknown repository name: - Whitelisted repository name: - Only files modified: - Advanced: Timestamp type: change Rescan: false
User role
Monitor, Analyst, Operator, or Admin
Supported appliances
This command is supported on the following appliance:
File Protect releases.