Displays the statistics about all the Web analysis incident jobs that are confirmed malicious, in descending order by job number. This command does not show incident information that was not deemed malicious. For details about displaying a list of all malicious and nonmalicious events, see .
Syntax
show incident all
Parameters
None
Output fields
The following table describes the output fields for the show incident all command. Fields are listed in the approximate order in which they appear in the output.
Field | Description |
|---|---|
Web Analysis Incident | Specific web analysis incident job number. |
Target OS | Guest image profile that was the target of the malware. |
Target Application | Application that was the target of the malware. |
Page URL | Page URL submitted to the virtual machine (VM) as a confirmed incident. |
Source IP | IP address of the source. |
Noticed At | Date and time that the confirmed incident was seen. |
Updated At | Date and time that the confirmed incident was updated. |
Events found | Number of events involved in the confirmed incident. |
URLs | Number of URLs involved in the confirmed incident. |
ContentType | Type of retrieved object, such as application or text. |
Example
The following example displays partial output of the statistics for all the Web analysis incident jobs that are confirmed:
hostname # show incident all
Web Analysis Incident: 6237
Target OS : Microsoft Windows7 32-bit 6.1 sp1 15.0826
Target Application : InternetExplorer 9.0
Page URL : perfectlearningsystems.com/38XTR9WQ.php?id=624200
Source IP : 34.232.235.10
Noticed At : 2015-09-24 22:26:31 PDT
Updated At : 2015-09-24 22:30:50 PDT
Events found : (1) 13(OS)
URLs : (6)
ContentType URL
--------------------------
text/html infantstrollerandcarseat.com/27.mp3?rnd=91095
text/html infantstrollerandcarseat.com/16201.mp3?rnd=19734
text/html perfectlearningsystems.com/38XTR9WQ.php?id=624200
text/html infantstrollerandcarseat.com/201403/_ev.htm
appl/x-shockwave-flash infantstrollerandcarseat.com/7815.swf
appl/x-silverlight-app infantstrollerandcarseat.com/1704.xap
Web Analysis Incident: 6235
Target OS : Microsoft WindowsXP 32-bit 5.1 sp3 15.0826
Target Application : InternetExplorer 7.0
Page URL : www.17gamo.com/co/ie7.htm
Source IP : 115.52.174.36
Noticed At : 2015-09-24 22:23:22 PDT
Updated At : 2015-09-24 22:27:45 PDT
Events found : (3) 9(NA) 8(SP) 7(OS)
URLs : (3)
ContentType URL
--------------------------
appl/octet-stream www.steoo.com/admin/win.exe
text/html www.17gamo.com/co/ie7.htm
text/html xn--18ba.xiaolen.com/
User role
Admin, Operator, Monitor, or Analyst
Command mode
Enable
Supported appliances
This command is supported on the following appliance running the specified release or later:
Network Security: Before Release 7.5