Configuring malware analysis settings

Use the CLI to configure sandbox malware analysis and live malware analysis.

Enabling URL Dynamic Analysis and Controlled Live Mode

You can enable URL Dynamic Analysis and Controlled Live Mode on the appliance using the following commands.

To enable:

analysis live url-dynamic-analysis enable
analysis live controlled-live-mode enable

To disable:

no analysis live url-dynamic-analysis enable
no analysis live controlled-live-mode enable

To configure live malware analysis settings:

Enable the CLI configuration mode.

hostname > enable
hostname # configure terminal

Enter the CLI command to configure for live malware analysis.
```
hostname (config) # analysis live
```
Ensure that the physical interface being used as the live interface has no IP address configured on it before executing this command.
Specify the external IP address and subnet mask for the ether2 port.
```
hostname (config) # analysis live external ip <IP address>/<CIDR notation>
```
For example, 192.168.211.129 /24 where <IP address> resides on the same network segment as the ether2 interface.
Specify the default gateway IP address for the ether2 network interface.
```
hostname (config) # analysis live default-gateway ip <IP address>
```
Specify the IP address for the MVX Guest Images for the Domain Name System (DNS).
```
hostname (config) # analysis live nameserver ip <IP address>
```
where <IP address> is accessed on the ether2 interface.
Verify the connection between the live ether2 interface and the Internet is configured correctly.
```
hostname (config) # manalysis live check-connection
```

The following example shows how to configure settings for live malware analysis:

hostname (config) # analysis live url-dynamic-analysis enable
hostname (config) # analysis live controlled-live-mode enable
hostname (config) # analysis live live-interface ether2
hostname (config) # analysis live external ip 192.168.211.129 /24
hostname (config) # analysis live default-gateway ip 192.168.211.1
hostname (config) # analysis live nameserver ip 8.8.8.8
hostname (config) # analysis live check-connection

Verifying the malware analysis settings

Use the show analysis live config command to verify the settings that you configured for live malware analysis and sandbox analysis.

To verify the settings for live malware analysis and sandbox analysis:

Enable the CLI configuration mode.

hostname > enable
hostname # configure terminal

Enter the show malware config command.

hostname (config) # show analysis live config

URL Dynamic Analysis feature    : yes 
Controlled live mode feature    : yes
Malware Download Timeout        : 120 (sec)
Malware Analysis VMs            : 100 (percent)
Download Disable Threshold      : 10
Download Disable Timeout        : 1500 (sec)

Live Analysis Configuration
    Interface                     : ether2
    Default Gateway               : 192.168.211.1
    External IP                   : 192.168.211.129/24
    Internal IP                   : 192.168.100.1/24
    Name Server                   : 8.8.8.8
    Http Proxy                    : 0.0.0.0:0
    Http Proxy Authentication     : /********
 
Filter packets going out live interface:
        Accept if dest addr is live mode DNS server: yes
        Accept if dest addr is live mode http proxy: yes
        Drop if dest addr on network of external IP: no
        Drop if dest addr on private subnet:         no