Use the CLI commands to enable or disable blocking files based on riskware detected by Trellix Riskware rules on the File Protect appliance using the CLI.
To enable blocking files based on riskware detected by Trellix Riskware rules :
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Enable blocking files based on riskware detected by Trellix Riskware rules on the appliance.
hostname (config) # analysis riskware policy fe-rules blockSave your changes.
hostname (config) # write memoryVerify the status of blocking files. The FireEye Riskware (Adware/PUP/Spam) rule will have Enabled in the Quarantine column.
hostname (config) # show analysis riskware policy rules|------------|-----------------------------------------------------------|------------|------------| | Rule ID | Rule | Alert Only | Quarantine | |------------|-----------------------------------------------------------|------------|------------| | 65000 | Jar Files Delivered Via Email Attachment Or Link | Disabled | Disabled | | 65001 | Encrypted MS Office Document | Disabled | Disabled | | 65002 | PDF, HWP or MS Office Files With Network Activity | Disabled | Disabled | . . . | 65037 | Suspicious DAA Archive Delivered via Email | Disabled | Disabled | | 65038 | Supply Chain Impersonation (8.4x) | Disabled | Disabled | | |Trellix Riskware (Adware/PUP/Spam) | Enabled | Enabled | |____________|___________________________________________________________|____________|____________|
To disable blocking files based on riskware detected by Trellix Riskware rules on the appliance:
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Disable blocking files based on riskware detected by Trellix Riskware rules on the appliance.
hostname (config) # no analysis riskware policy fe-rules blockSave your changes.
hostname (config) # write memory