Configuring intrinsic analysis to be performed in the DTI cloud using the CLI

This procedure describes how to use CLI commands to configure the Intelligent Virtual Execution - Server appliance to perform intrinsic analysis in the DTI cloud. Malware intrinsic analysis is performed in the DTI cloud by default. You can change the location where malware intrinsic analysis occurs by using CLI commands only. A two-way sharing CONTENT_UPDATES license is required.

When intrinsic analysis is performed from the DTI cloud with a two-way sharing content license, objects are analyzed and compared against a larger set of known malware families. The compute node can upload malware samples to the DTI network for analysis with a two-way content license.

When intrinsic analysis is performed locally on the Intelligent Virtual Execution - Server appliance with a one-way sharing content license, malware samples will not be submitted to the DTI Cloud.

Prerequisites

Operator or Admin access

A two-way sharing CONTENT_UPDATES license is installed on the Intelligent Virtual Execution - Server appliance. To verify, use the show licenses command. The command output must include the following line for the CONTENT_UPDATES license information:

Sharing:          all (ok)

Example:

hostname (config) # show licenses
License 1: LK2-CONTENT_UPDATES-1111-1111-1111-1111-1111-1111-1111-1111-1111-1111-1111-1111-1111-1111
   Feature:          CONTENT_UPDATES
   Description:      Content updates
   Valid:            yes
   Start date:       2016/05/03 (ok)
   End date:         2017/05/03 (ok)
   Tied to appl ID:  0CC47A31C5F8 (ok)
   Sharing:          all (ok)
   Active:           yes
 
License 2: LK2-FIREEYE_APPLIANCE-2222-2222-2222-2222-2222-2222-2222-2222-2222-2222-2222-2222-2222-2222-2222-2222-2222-2
   ...

Static analysis is enabled on the Intelligent Virtual Execution - Server appliance. Check the "Static Analysis enabled" field in the output of the show static‑analysis config command.
The intrinsic analysis component of static analysis has been enabled. Check the "Malware Intrinsic Analysis enabled" field in the output of the show static-analysis config command.
The AV-suite integration component of static analysis is enabled.
To verify, use the show static-analysis config command.
The DTI access on the Intelligent Virtual Execution - Server appliance has been validated.
To verify, use the show fenet status command. See Validating DTI access using the CLI for details.

To configure intrinsic analysis from the DTI Cloud:

Go to CLI configuration mode.

vx-hostname > enable
vx-hostname # configure terminal

Configure the DTI service for intrinsic analysis on the Intelligent Virtual Execution - Server appliance.
```
vx-hostname (config) # malware-intrinsic-analysis dti
```
If Intrinsic Analysis is disabled, the command output displays the following message:
```
% Malware Intrinsic Analysis(MIA) is currently disabled. Cannot change MIA configuration. Please enable MIA to change configuration.
```

Verify the status of intrinsic analysis from the DTI Cloud.

vx-hostname (config) # show static-analysis config
 
  Static Analysis enabled                : yes
    AV-suite enabled                     : yes
    AV-check enabled                     : yes
    Dropper enabled                      : no
    YARA enabled                         : yes
    Malware Intrinsic Analysis enabled   : yes (DTI)
  Embedded object extraction enabled     : no
  Static info policy                     : Disable
 
  Yara Configuration
    Yara policy                          : both
    Yara customer match limit            : 5
    Yara customer default weight         : 0
 
  Malware Whitelist Past Hours           : 24
  Malware Blacklist Past Hours           : 4
  Analysis reset duplicate since         : 2016/07/07 22:46:16
  Mobile Threat Prevention               : yes

Save your changes.
```
vx-hostname (config) # write memory
```