Displays the workorder information for a specific range of malware submissions. The malware submission jobs are listed in ascending order by submission ID.
Syntax
show workorders range <start_range_workorderID> [<end_range_workorderID>]Parameters
start_range_workorderIDend_range_workorderIDThe workorder ID of the first workorder in the range.
(Optional) End of the range of the malware submissions.
Output fields
The following table describes the output fields for the show workorders range command. Fields are listed in the approximate order in which they appear in the output.
Field | Description |
|---|---|
Submission ID | Specific malware submission job number. |
Malware ID | Specific malware analysis job number. |
Source IpAddress | IP address of the source. |
Destination IpAddress | IP address of the destination. |
md5sum | Md5 checksum of the attachment. |
File type | File type that is associated with the malware submission job. |
Status | Whether the analysis succeeded or failed. |
Malicious | Whether the malware submission was detected as malicious. |
Analysis Object ID | Analysis object job number that is associated with the malware submission. |
Analysis Object Name | Analysis object name that is associated with the malware submission job. |
Analysis File Type | Analysis file type that is associated with the malware submission job. |
Static Analysis weight | Weight that is assigned to a static analysis job on a particular object. |
Dynamic Analysis weight | Weight that is assigned to a dynamic analysis job on a particular object. |
Dynamic Analysis jobs | Number of dynamic analysis jobs that have been processed on a particular object. |
Static Analysis jobs | Number of static analysis jobs that have been processed on a particular object. |
Job ID | Job number that is associated with the malware submission. |
OS Name | Guest image profile. |
Application name | Application used to test the content. |
OS Changes weight | Weight assigned based on a correlation between a set of rules and a set of operating system (OS) change activities detected by the virtual machine (VM) during dynamic analysis. |
CNC Match weight | Weight that is assigned by a custom rule that is used for callback detection on a VM during dynamic analysis. |
Assigned time | Timestamp generated when the malware submission started the detection operation on a VM. |
Complete time | Timestamp generated when the malware submission completed the detection operation on a VM. |
Job runtime | Time needed to complete the malware submission job. |
Examples
The following example displays the workorder information for a specific range of malware submissions:
hostname # show workorders range 1730 1732
Submission ID: 1730
Malware ID : 1733
Source IpAddress : 48.119.120.67
Destination IpAddress : 100.53.48.73
md5sum : feb430d8a66fbc095eec1394cb58e2dd
File type : exe
Status : success
Malicious : YES
Analysis Object ID : 1568
Analysis Object Name : feb430d8a66fbc095eec1394cb58e2dd.bin
Analysis File Type : exe
md5sum : feb430d8a66fbc095eec1394cb58e2dd
Static Analysis weight : 100
Dynamic Analysis weight : 2100
Dynamic Analysis jobs : 2
Static Analysis jobs : 4
SA engine weight : 100
SA job ID : 6270
SA sub-engine name : clamd
SA sub-engine signature : Win.Trojan.Cycbot-2623
SA sub-engine weight : 80
SA sub-engine name : sophos
SA sub-engine signature : Mal/ZAccess-BL
SA sub-engine weight : 100
SA engine weight : 100
SA job ID : 6269
SA sub-engine name : avs
SA sub-engine signature : Trojan.Generic
SA sub-engine weight : 100
Job ID : 3102
OS name : winxp-sp3
Application name : Windows Explorer
OS Changes weight : 700
CNC Match weight : 1300
Assigned time : 2015-09-14 17:02:38.064663
Complete time : 2015-09-14 17:06:39.897613
Job runtime : 00:04:01.83295
Job ID : 3103
OS name : win7x64-sp1
Application name : Windows Explorer
OS Changes weight : 700
CNC Match weight : 1400
Assigned time : 2015-09-14 17:02:43.078803
Complete time : 2015-09-14 17:06:47.402008
Job runtime : 00:04:04.323205
Submission ID: 1731
Malware ID : 1728
Incident ID : 4848
Source IpAddress : 73.50.121.119
Destination IpAddress : 111.80.48.88
File type : url
Status : timeout
Malicious : NO
Submission ID: 1732
Malware ID : 1736
Source IpAddress : 116.48.102.118
Destination IpAddress : 65.87.52.107
md5sum : feb4a63326cd0b8649e5ad520534efa6
File type : exe
Status : success
Malicious : YES
Analysis Object ID : 1569
Analysis Object Name : feb4a63326cd0b8649e5ad520534efa6.bin
Analysis File Type : exe
md5sum : feb4a63326cd0b8649e5ad520534efa6
Static Analysis weight : 100
Dynamic Analysis weight : 600
Dynamic Analysis jobs : 2
Static Analysis jobs : 4
SA engine weight : 100
SA job ID : 6273
SA sub-engine name : avs
SA sub-engine signature : Trojan.Generic
SA sub-engine weight : 100
SA engine weight : 100
SA job ID : 6274
SA sub-engine name : clamd
SA sub-engine signature : Trojan.Vbkrypt-150
SA sub-engine weight : 80
SA sub-engine name : sophos
SA sub-engine signature : Mal/VBCheMan-C
SA sub-engine weight : 100
Job ID : 3104
OS name : winxp-sp3
Application name : Windows Explorer
OS Changes weight : 600
CNC Match weight : 0
Assigned time : 2015-09-14 17:06:40.276143
Complete time : 2015-09-14 17:10:51.846534
Job runtime : 00:04:11.570391
Job ID : 3105
OS name : win7x64-sp1
Application name : Windows Explorer
OS Changes weight : 600
CNC Match weight : 0
Assigned time : 2015-09-14 17:06:48.059052
Complete time : 2015-09-14 17:11:02.739536
Job runtime : 00:04:14.680484
User role
Admin, Monitor, or Analyst.
Command mode
Enable
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Network Security: Before Release 7.5. The command output was enhanced to display the statistics about a specific malware submission job in Release 7.7.