Enabling or disabling riskware detection custom policy rules using the CLI

Use the CLI commands in this procedure to enable or disable riskware detection custom policy rules on the Malware Analysis appliance.

To enable riskware detection custom policy rules:

hostname (config) # show analysis riskware policy rules

Go to CLI configuration mode.

hostname > enable
hostname # configure terminal

Locate the policy rule ID you want to enable.

Enable a particular policy rule ID.

hostname (config) # analysis riskware policy rule <rule_ID> enable

Save your changes.
```
hostname (config) # write memory
```
Verify the status of a custom policy rule for riskware detection.
```
hostname (config) # show analysis riskware policy rules
```

To disable riskware detection custom policy rules:

hostname (config) # show analysis riskware policy rules

Go to CLI configuration mode.

hostname > enable
hostname # configure terminal

Locate the policy rule ID you want to disable.

Disable a particular policy rule ID.

hostname (config) # no analysis riskware policy rule <rule_ID> enable

Save your changes.
```
hostname (config) # write memory
```
Verify the status of a custom policy rule for riskware detection.
```
hostname (config) # show analysis riskware policy rules
```

Examples

This example enables a custom policy rule ID for riskware detection.

hostname (config) # analysis riskware policy rule 65005 enable

This example disables a custom policy rule ID for riskware detection.

hostname (config) # no analysis riskware policy rule 65006 enable

This example shows the current custom policy rule configuration for riskware detection.

>hostname (config) # show analysis riskware policy rules 
|------------|------------------------------------------------------------|------------|
|    Rule ID |                                                       Rule | Alert Only |
|------------|------------------------------------------------------------|------------|
|      65005 |               Low Confidence Custom Yara Rule Weights 0-50 |   Disabled |
|      65006 |             High Confidence Custom Yara Rule Weights 51-99 |   Disabled |
|      65009 |   Non Executable file Connecting to Non-Standard High Port |   Disabled |
|      65012 | MS Office Document With Macro Activity Dropping a exe file |   Disabled |
|      65013 |     Password From Web Forms Sent as Plaintext Http_Request |   Disabled |
|      65020 |                    MS Office Document running Flash Events |   Disabled |
|      65021 |           MS Office Document With Password Protected Macro |   Disabled |
|      65029 |     Provided list of extensions marked for Policy Blocking |   Disabled |
|      65031 |                      Potential Risky ScreenSaver Indicator |   Disabled |
|      65035 |                         Low Confidence Malware Guard on NX |   Disabled |
|            |Trellix Riskware (Adware/PUP/Spam) |    Enabled |
|____________|____________________________________________________________|____________|