Enabling malware intrinsic analysis using the CLI

Prev Next

This procedure describes how to use CLI commands to re-enable the malware intrinsic analysis component of static analysis. Malware intrinsic analysis is enabled by default. You can disable and re-enable intrinsic analysis by using CLI commands only. When intrinsic analysis is re-enabled, no other configuration is required.

Prerequisites
  • Operator or Admin access.

  • Static analysis is enabled on the Intelligent Virtual Execution - Server appliance. Check the "Static Analysis enabled" field in the output of the show static‑analysis config command.

  • The latest Trellix security content with the new malware samples downloaded and installed on the Network Security sensors that are enrolled with the MVX cluster. Use the fenet security-content apply-update command.

To enable the intrinsic analysis component of static analysis:
  1. Go to CLI configuration mode.

    vx-hostname > enable
    vx-hostname # configure terminal
  2. Enable malware intrinsic analysis.

    vx-hostname (config) # static-analysis malware-intrinsic-analysis enable
  3. Verify that malware intrinsic analysis is enabled.

    vx-hostname (config) # show static-analysis config
     
      Static Analysis enabled                : yes
        AV-suite enabled                     : yes
        AV-check enabled                     : yes
        Dropper enabled                      : no
        YARA enabled                         : yes
        Malware Intrinsic Analysis enabled   : yes (DTI)
      Embedded object extraction enabled     : no
      Static info policy                     : Disable
     
      Yara Configuration
        Yara policy                          : both
        Yara customer match limit            : 5
        Yara customer default weight         : 0
     
      Malware Whitelist Past Hours           : 24
      Malware Blacklist Past Hours           : 4
      Analysis reset duplicate since         : 2016/07/07 22:46:16
      Mobile Threat Prevention               : yes
  4. Save your changes.

    vx-hostname (config) # write memory