Enabling AV‑suite integration using the CLI

This procedure describes how to use CLI commands to enable the AV-suite integration component of static analysis. AV-suite is enabled by default. You can disable and re-enable AV-suite by using CLI commands only. A two-way sharing CONTENT_UPDATES license is required.

Note
AV-suite version 6 must be configured for AV-Suite to receive suspicious object hashes through the DTI network to determine whether the object hashes have been seen before.

Prerequisites

A two-way sharing CONTENT_UPDATES license is installed on the Intelligent Virtual Execution - Server appliance. To verify, use the show licenses command. The command output must include the following line for the CONTENT_UPDATES license information:

Sharing:          all (ok)

Example:

hostname (config) # show licenses
License 1: LK2-CONTENT_UPDATES-1111-1111-1111-1111-1111-1111-1111-1111-1111-1111-1111-1111-1111-1111
   Feature:          CONTENT_UPDATES
   Description:      Content updates
   Valid:            yes
   Start date:       2016/05/03 (ok)
   End date:         2017/05/03 (ok)
   Tied to appl ID:  0CC47A31C5F8 (ok)
   Sharing:          all (ok)
   Active:           yes
 
License 2: LK2-FIREEYE_APPLIANCE-2222-2222-2222-2222-2222-2222-2222-2222-2222-2222-2222-2222-2222-2222-2222-2222-2222-2
   ...

Operator or Admin access.
Static analysis is enabled on the Intelligent Virtual Execution - Server appliance. Check the "Static Analysis enabled" field in the output of the show static‑analysis config command.

To enable the AV‑suite integration component of static analysis:

Go to CLI configuration mode.

vx-hostname > enable
vx-hostname # configure terminal

Enable AV‑suite integration.

vx-hostname (config) # static-analysis av-suite enable

Verify that AV‑suite integration is enabled.

vx-hostname (config) # show static-analysis config
 
  Static Analysis enabled              : yes
   AV-suite enabled                   : yes
    AV-suite version                   : 6
    SA on AV-suite whitelist enabled   : no
    AV-check enabled                   : yes
    Dropper enabled                    : yes
    YARA enabled                       : yes
    
  Embedded object extraction enabled   : no
  Embedded URL extraction enabled      : yes
  Max URLs from files to be analyzed   : 5 
  Static info policy                   : Disable
 
  Yara Configuration
    Yara policy                        : both
    Yara customer match limit          : 5
    Yara customer default weight       : 0
 ........

Save your changes.
```
vx-hostname (config) # write memory
```