Displays the workorder information that are ordered by traces for the malware submissions based on a source IP address.
Syntax
show workorders traces src <IP_address>Parameters
None
Output fields
The following table describes the output fields for the show workorders traces src command. Fields are listed in the approximate order in which they appear in the output.
Field | Description |
|---|---|
Submission ID | Specific malware submission job number. |
Malware ID | Specific malware analysis job number. |
Source IpAddress | IP address of the source. |
Destination IpAddress | IP address of the destination. |
md5sum | MD5 checksum of the attachment. |
File type | File type that is associated with the malware submission job. |
Status | Whether the analysis succeeded or failed. |
Malicious | Whether the malware submission was detected as malicious. |
Analysis Object ID | Analysis object job number that is associated with the malware submission. |
Analysis Object Name | Analysis object name that is associated with the malware submission job. |
Analysis File Type | Analysis file type that is associated with the malware submission job. |
Static Analysis weight | Weight that is assigned to a static analysis job on a particular object. |
Dynamic Analysis weight | Weight that is assigned to a dynamic analysis job on a particular object. |
Dynamic Analysis jobs | Number of dynamic analysis jobs that have been processed on a particular object. |
Static Analysis jobs | Number of static analysis jobs that have been processed on a particular object. |
Job ID | Job number that is associated with the malware submission. |
OS name | Guest image profile. |
Application name | Application used to test the content. |
OS Changes weight | Weight assigned based on a correlation between a set of rules and a set of operating system (OS) change activities detected by the virtual machine (VM) during dynamic analysis. |
CNC Match weight | Weight that is assigned by a custom rule that is used for callback detection on a VM during dynamic analysis. |
Assigned time | Timestamp generated when the malware submission job started the detection operation on a VM. |
Complete time | Timestamp generated when the malware submission job completed the detection operation on a VM. |
Job runtime | Time needed to complete the malware submission job. |
Examples
The following example displays the workorder information that is ordered by traces for the malware submissions based on a particular source IP address:
hostname # show workorders traces src 116.98.71.72
Submission ID: 1743
Malware ID : 1746
Source IpAddress : 116.98.71.72
Destination IpAddress : 111.68.67.73
md5sum : fefbe2912c3a7203b24315333d9b63bf
File type : exe
Status : success
Malicious : YES
Analysis Object ID : 1576
Analysis Object Name : fefbe2912c3a7203b24315333d9b63bf.bin
Analysis File Type : exe
md5sum : fefbe2912c3a7203b24315333d9b63bf
Static Analysis weight : 100
Dynamic Analysis weight : 100
Dynamic Analysis jobs : 2
Static Analysis jobs : 4
SA engine weight : 100
SA job ID : 6302
SA sub-engine name : pe_sign
SA sub-engine signature : Solimba Aplicaciones S.L.
SA sub-engine weight : 0
SA sub-engine name : clamd
SA sub-engine signature : Win.Adware.Solimba-32
SA sub-engine weight : 80
Job ID : 3118
OS name : winxp-sp3
Application name : Windows Explorer
OS Changes weight : 100
CNC Match weight : 0
Assigned time : 2015-09-14 17:22:49.876632
Complete time : 2015-09-14 17:24:52.07346
Job runtime : 00:02:02.196828
Job ID : 3119
OS name : win7x64-sp1
Application name : Windows Explorer
OS Changes weight : 100
CNC Match weight : 0
Assigned time : 2015-09-14 17:24:52.967059
Complete time : 2015-09-14 17:26:54.859699
Job runtime : 00:02:01.89264
User role
Admin, Monitor, or Analyst.
Command mode
Enable
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Network Security: Before Release 7.5. The command output was enhanced to display the statistics about a specific malware submission job in Release 7.7.