Enabling or disabling riskware detection policy rules using the CLI

Use the CLI commands to enable or disable riskware detection policy rules on the File Protect appliance.

To enable riskware detection policy rules:

Go to CLI configuration mode.

hostname > enable
hostname # configure terminal

Locate the policy rule ID you want to enable.
hostname (config) # show analysis riskware policy rules

Enable a particular policy rule ID.

hostname (config) # analysis riskware policy rule <rule_ID> enable

Save your changes.
```
hostname (config) # write memory
```
Verify the status of a policy rule for riskware detection.
```
hostname (config) # show analysis riskware policy rules
```

To disable riskware detection policy rules:

Go to CLI configuration mode.

hostname > enable
hostname # configure terminal

Locate the policy rule ID you want to disable.
hostname (config) # show analysis riskware policy rules

Disable a particular policy rule ID.

hostname (config) # no analysis riskware policy rule <rule_ID> enable

Save your changes.
```
hostname (config) # write memory
```
Verify the status of a policy rule for riskware detection.
```
hostname (config) # show analysis riskware policy rules
```

Examples

This example enables a policy rule ID for riskware detection.

hostname (config) # analysis riskware policy rule 65000 enable

This example disables a policy rule ID for riskware detection.

hostname (config) # no analysis riskware policy rule 65001 enable

This example shows the current policy rule configuration for riskware detection.

hostname (config) # show analysis riskware policy rules 
|----------|--------------------------------------------------|------------|------------|
|  Rule ID |                                             Rule | Alert Only | Quarantine |
|----------|--------------------------------------------------|------------|------------|
|    65000 | Jar Files Delivered Via Email Attachment Or Link |    Enabled |   Disabled |
|    65001 |                     Encrypted MSOffice Document  |    Enabled |   Disabled |
|    65002 |     MS Office Files With Network Activity Policy |    Enabled |   Disabled |
|    65003 |                   Executable Delivered via Email |    Enabled |   Disabled |
|    65004 |                       Script Delivered via Email |    Enabled |   Disabled |
|    65005 |     Low Confidence Custom Yara Rule Weights 0-50 |    Enabled |    Enabled |
|    65006 |  High Confidence Custom Yara Rule Weights 51-100 |    Enabled |   Disabled |
|    65007 |          MS Office Document With Embedded Object |    Enabled |   Disabled |
|    65008 |           MS Office Document With Macro Activity |    Enabled |   Disabled |
|    65009 |                   Non Executable file Connecting |            |            |
|          |                        to Non-Standard High Port |    Enabled |   Disabled |
.
.
.
|    65038 |   Supply Chain Impersonation (8.4x) |   Disabled |   Disabled |
|          |Trellix Riskware (Adware/PUP/Spam) |    Enabled |   Disabled |
|__________|__________________________________________________|____________|____________|