Displays information for a specific malware submission job number.
Syntax
show submission id <submission_ID>
Parameters
None
Output fields
The following table describes the output fields for the show submission id command. Fields are listed in the approximate order in which they appear in the output.
Field | Description |
|---|---|
Submission ID | Specific malware submission job number. |
Queue ID | Email queue ID of the specified submission ID. |
UUID | Specific universally unique identifier that is associated with the malware submission on an integrated Network Security appliance or a Network Security sensor. |
Malware ID | Specific malware analysis job number. |
Source IpAddress | IP address of the source. |
Destination IpAddress | IP address of the destination. |
File type | File type that is associated with the malware submission job. |
Status | Whether the analysis succeeded or failed. This field also displays the status for a retroactive alert that is marked as |
Malicious | Whether the malware submission job was detected as malicious. |
Analysis Object ID | Analysis object job number that is associated with the malware submission. |
Analysis Object Name | Analysis object name that is associated with the malware submission job. |
Analysis File Type | Analysis file type that is associated with the malware submission job. |
Dynamic Analysis weight | Weight that is assigned to a dynamic analysis job on a particular object. |
Dynamic Analysis jobs | Number of dynamic analysis jobs that have been processed on a particular object. |
Job ID | Job number that is associated with the malware submission. |
OS name | Type of guest image profile. |
Application name | Type of application. |
OS Changes weight | Weight assigned based on a correlation between a set of rules and a set of operating system (OS) change activities detected by the virtual machine (VM) during dynamic analysis. |
CNC Match weight | Weight that is assigned by a custom rule that is used for callback detection on a VM during dynamic analysis. |
Assigned time | Timestamp generated when the malware submission job started the detection operation on a VM. |
Complete time | Timestamp generated when the malware submission job completed the detection operation on a VM. |
Job runtime | Time needed to complete the malware submission job. |
Examples
The following example displays the information about job number 8:
hostname # show submission id 8
Submission ID: 8
UUID : e2e25565-20bd-4148-a435-2d761077a55b
Queue ID : 48xc1f0d01z3VQdw
Malware ID : 16
Source IpAddress : 108.157.161.251
Destination IpAddress : 238.174.95.154
md5sum : 77b6d8fa25ef0be3aced5c31bcec35fe
File type : exe
Status : success
Malicious : YES
Analysis Object ID : 7
Analysis Object Name : 014s.exe
Analysis File Type : exe
md5sum : 77b6d8fa25ef0be3aced5c31bcec35fe
Static Analysis weight : 100
Dynamic Analysis weight : 100
Dynamic Analysis jobs : 2
Static Analysis jobs : 4
SA engine weight : 100
SA job ID : 17
SA sub-engine name : avs
SA sub-engine signature : Trojan.Generic
SA sub-engine weight : 100
SA engine weight : 80
SA job ID : 18
SA sub-engine name : clamd
SA sub-engine signature : PUA.Win.Packer.Upack-48
SA sub-engine weight : 80
Job ID : 12
OS name : win7x64-sp1
Application name : Windows Explorer
OS Changes weight : 100
CNC Match weight : 0
Assigned time : 2016-04-28 00:39:33.851213
Complete time : 2016-04-28 00:43:36.324287
Job runtime : 00:04:02.473074
Signature : Malware.Binary.exe
Job ID : 11
OS name : winxp-sp3
Application name : Windows Explorer
OS Changes weight : 100
CNC Match weight : 0
Assigned time : 2016-04-28 00:36:47.52572
Complete time : 2016-04-28 00:40:48.744118
Job runtime : 00:04:01.218398
Signature : Malware.Binary.exe
The following example displays the submission status for a retroactive alert that is marked as dti_detection in the output field:
hostname # show submission id 305
Submission ID: 305
UUID : ab967fd7-ec0c-452f-bf50-fddd5e2f725c
Malware ID : 377
Source IpAddress : 88.103.115.101
Destination IpAddress : 87.113.80.75
md5sum : aa53deab960b2977fe8d4b775c5b4a1e
File type : exe
Status : dti_detection
Malicious : YES
User role
Administrator, Monitor, Operator, and Analyst
Command mode
Enable
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Malware Analysis: Release 7.7
File Protect: Release 7.7
Network Security: Release 7.7. The command output was enhanced to include the UUID field on an integrated Network Security appliance or a Network Security sensor in Release 7.9.
Email Security — Server: Release 7.8