Use the CLI commands to enable or disable AV-Suite integration between the appliance and the DTI Cloud on whitelist submissions. When static analysis and AV-Suite integration on whitelist submissions are enabled on the appliance, the submitted malware samples that are marked with the verdict "Clean" by the AV-Suite service will be included in static analysis. For details about AV-Suite, see AV-Suite.
Note
AV-Suite integration on whitelist submissions is disabled by default.
Prerequisites
Administrator or Operator access to the Intelligent Virtual Execution - Server appliance
An established connection to the Internet
A connection to the DTI Cloud
A two-way sharing CONTENT_UPDATES license
A FIREEYE_SUPPORT license
Verify that static analysis is enabled on the appliance. Use the
show static-analysis configcommand.Verify that AV-Suite integration is enabled on the appliance. Use the
show static-analysis configcommand.
To enable AV-Suite integration on whitelist submissions:
Enable the CLI configuration mode.
vx-hostname > enable vx-hostname # configure terminalEnable AV-Suite integration on whitelist submissions on the appliance.
vx-hostname (config) # static-analysis av-suite whitelist enableSave your changes.
vx-hostname (config) # write memoryVerify the status of AV-Suite integration on whitelist submissions.
vx-hostname (config) # show static-analysis configStatic Analysis enabled : yes AV-suite enabled : yes AV-suite version : 6 SA on AV-suite whitelist enabled : yes AV-check enabled : yes Dropper enabled : yes YARA enabled : yes .....The "SA on AV-suite whitelist enabled" line displays "yes" if AV-Suite integration on whitelist submissions is enabled.
To disable AV-Suite integration on whitelist submissions:
Enable the CLI configuration mode.
vx-hostname > enable vx-hostname # configure terminalDisable AV-Suite integration on whitelist submissions on the appliance.
vx-hostname (config) # no static-analysis av-suite whitelist enableSave your changes.
vx-hostname (config) # write memoryVerify the status of AV-Suite integration on whitelist submissions.
vx-hostname (config) # show static-analysis configStatic Analysis enabled : yes AV-suite enabled : yes AV-suite version : 6 SA on AV-suite whitelist enabled : no AV-check enabled : yes Dropper enabled : yes YARA enabled : yes .....The "SA on AV-suite whitelist enabled" line displays "no" if AV-Suite integration on whitelist submissions is disabled.