Displays a list of all completed workorders for the malware submission jobs whose static and dynamic analysis have finished. This command returns information such as the type of file, status of the malware submission, analysis object that is associated with the submission job, and so on. The malware submission jobs are listed in ascending order by submission ID. You can display up to 100 jobs by default.
Syntax
show workorders done [limit <number>]Parameters
limit <number>(Optional) Displays the specified number of entries that have completed static and dynamic analysis jobs. A higher number might increase command response time.
Output fields
The following table describes the output fields for the show workorders done command. Fields are listed in the approximate order in which they appear in the output.
Field | Description |
|---|---|
Submission ID | Specific malware submission job number. |
Incident ID | Specific confirmed incident job number. |
File type | File type that is associated with the malware submission job. |
Status | Whether the analysis succeeded or failed. |
Malicious | Whether the malware submission job was detected as malicious. |
Analysis Object ID | Analysis object job number that is associated with the malware submission. |
Analysis Object Name | Analysis object name that is associated with the malware submission job. |
Analysis File Type | Analysis file type that is associated with the malware submission job. |
Dynamic Analysis weight | Weight that is assigned to a dynamic analysis job on a particular object. |
Dynamic Analysis jobs | Number of dynamic analysis jobs that have been processed on a particular object. |
Job ID | Job number that is associated with the malware submission. |
OS name | Guest image profile. |
Application name | Application used to test the content. |
OS Changes weight | Weight assigned based on a correlation between a set of rules and a set of operating system (OS) change activities detected by the virtual machine (VM) during dynamic analysis. |
CNC Match weight | Weight that is assigned by a custom rule that is used for callback detection on a VM during dynamic analysis. |
Assigned time | Timestamp generated when the malware submission started the detection operation on a VM. |
Complete time | Timestamp generated when the malware submission completed the detection operation on a VM. |
Job runtime | Time needed to complete the malware submission job. |
Examples
The following example displays a limit of one completed workorder for all malware submissions whose static and dynamic analysis jobs are finished:
hostname # show workorders done limit 1
Submission ID: 27205
Incident ID : 27205
File type : url
Status : success
Malicious : YES
Analysis Object ID : 20700
Analysis Object Name : http://thisone.ishi.4pu.com/openstat/appropriate/promise-ourselves.php
Analysis File Type : url
Dynamic Analysis weight : 100
Dynamic Analysis jobs : 2
Job ID : 24327
OS name : win7-sp1
Application name : Firefox 13.0
OS Changes weight : 100
CNC Match weight : 0
Assigned time : 2015-10-30 17:08:38.748884
Complete time : 2015-10-30 17:09:43.842162
Job runtime : 00:01:05.093278
Job ID : 24328
OS name : winxp-sp3
Application name : Firefox 6.0
OS Changes weight : 100
CNC Match weight : 0
Assigned time : 2015-10-30 17:08:38.787971
Complete time : 2015-10-30 17:09:22.81773
Job runtime : 00:00:44.029759
User role
Admin, Monitor, or Analyst.
Command Mode
Enable
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Network Security: Before Release 7.5. The command output was enhanced to display the statistics about a specific malware submission job in Release 7.7.