Filtering scans using the CLI

Prev Next

Use the commands in this section to define filters that limit the scope of the scan.

Note

You can use these commands only on scans that are in the "configured" state. You cannot configure active, paused, aborted, completed, or scheduled scans.

Note

See Scan configuration concepts for detailed descriptions of the filters.

To define scan filters:
  1. Enable the CLI configuration mode:

    hostname > enable
    hostname # configure terminal
  2. To scan only specific file types:

    hostname (config) # fmps scan configure scanID filetypes select fileTypes

    where fileTypes are any of the file extensions enabled for any guest profile on the Settings: Malware File Assoc. page in the File Protect Web UI, separated by spaces.

    Caution

    If you specify a file type that is later disabled on the Settings>Malware File Assoc. page, subsequent scans will skip those files.

  3. To whitelist file types so they are not scanned:

    hostname (config) # fmps scan configure scanID filetypes whitelist fileTypes

    where fileTypes are any of the file extensions the File Protect appliance knows about, separated by spaces.

    Note

    You can see a list of these file extensions in Filter this Scan step of the Configure a Scan wizard. See Using the Configure a Scan Wizard.

  4. To only scan files that were added or changed after a specific date and time:

    hostname (config) # fmps scan configure scanID start-time after YYYY/MM/DDHH:mm:ss

    where YYYY is the year, MM is the month (01-12), DD is the day (01-31), HH is the hour (01-23), mm is the minute (01-59), and ss is the second (01-59).

  5. To only scan files that were added or changed since a specific period of time:

    hostname (config) # fmps scan configure scanID start-time since number days number hours number minutes number seconds

    Note

    To exclude a parameter, specify 0 as its value. For example, to specify "since 12 hours ago," enter 0 days 12 hours 0 minutes 0 seconds.

  6. To scan files in a specific subdirectory:

    hostname (config) # fmps scan configure scanID subdirectories subdirectory
  7. To configure file types for dynamic analysis:

    hostname (config) # fmps scan configure scanID dynamic-analysis file-types
  8. To disable file types for dynamic analysis:

    hostname (config) # no fmps scan configure scanID dynamic-analysis file-types
  9. Save your changes:

    hostname (config) # write memory

Examples

The following example specifies that scan 71 should analyze .doc, .docx, .pdf, and .ppt files, whitelist .asf files and configure .bat and .arj files for dynamic analysis. It checks files in the Assets subdirectory that were added or changed over the past 30 days.

hostname (config) # fmps scan configure 71 filetypes select doc docx pdf ppt
hostname (config) # fmps scan configure 71 filetypes whitelist asf
hostname (config) # fmps scan configure 71 dynamic analysis bat arj
hostname (config) # fmps scan configure 71 subdirectories Assets
hostname (config) # fmps scan configure 71 start-time since 30 days 0 hours 0 minutes 0 seconds

The following example shows the specified filters in bold.

hostname (config) # show fmps scan-id 71
Scan ID 71 (State: Configured Description: Scan configured)
Scan type: -
Scan name: -
Share name: Acme_IT
Share URL: //10.14.40.30/IX1
Filetype whitelist: asfSelected filetypes: doc docx pdf ppt
Quarantine repository name: -
Good repository name: -
Unknown repository name: -
Whitelisted repository name: -
Only files modified: since 30 days 0 hours 0 minutes 0 secondsSubdirectories: Assets
Advanced:
    Timestamp type: change
    Rescan: false