A SmartVision appliance monitors the transfer of objects over SMB and SMB 2, and it extracts and submits interesting objects to the cloud MVX service or on-premises MVX cluster for inspection and analysis.
This procedure describes how to use CLI commands to view statistics about the number of SMB and SMB 2 object transfers that the SmartVision appliance observed and how many objects were submitted for MVX analysis.
Prerequisites
View the SMB traffic statistics.
hostname # show smartvision smb-stats
Examples
The following example shows that, during the elapsed time period, 9 SMB objects and 3 SMB 2 objects were transferred and all of them have been submitted for MVX analysis.
hostname # show smartvision smb-stats
Time:
Start: Thu Aug 17 18:44:48 2017
Capture: Mon Aug 17 17:09:16 2017
Elapsed: 958m 10s
Poll: 60s
SMB Object Statistics
Total Rate/min(avg) Rate/min(curr)
SMB Objects 9 0 0
SMB2 Objects 3 0 0
SMB Submissions 9 0 0
SMB2 Submissions 3 0 0Note
The show smartvision smb-stats command does not show the file types that were observed.
For a deeper dive into the type of objects seen, view the Trellix Unified Multiflow Engine (FUME) statistics for incoming objects:
hostname # show fume object stats
Time:
Start: Thu Aug 17 03:11:31 2017
Capture: Thu Aug 17 19:58:39 2017
Elapsed: 837m 45s
Poll: 60s
Incoming Traffic Stats:
WEB Total Rate/min(avg) Rate/min(curr)
url 21 0.025 0.000
OBJECT Total Rate/min(avg) Rate/min(curr)
dylib 0 0.000 0.000
lnk 0 0.000 0.000
bz2 0 0.000 0.000
dll 2 0.002 0.000
chm 0 0.000 0.000
cab 0 0.000 0.000
vbs 0 0.000 0.000
ps1 0 0.000 0.000
rar 0 0.000 0.000
jnlp 0 0.000 0.000
class 0 0.000 0.000
xap 0 0.000 0.000
rtf 0 0.000 0.000
xar 0 0.000 0.000
zip 0 0.000 0.000
exe 7 0.008 0.000
osxapp 0 0.000 0.000
jar 0 0.000 0.000
fdf 0 0.000 0.000
gzip 0 0.000 0.000
js 0 0.000 0.000
hwp 0 0.000 0.000
html 0 0.000 0.000
dmg 0 0.000 0.000
hlp 0 0.000 0.000
ace 0 0.000 0.000
xml 0 0.000 0.000
swf 0 0.000 0.000
arj 0 0.000 0.000
macho 0 0.000 0.000
7z 0 0.000 0.000
ooxml 0 0.000 0.000
cdf 0 0.000 0.000
img 0 0.000 0.000
elf 0 0.000 0.000
xdp 0 0.000 0.000
pdf 0 0.000 0.000
tar 0 0.000 0.000Note
The show fume object stats command output does not show whether the traffic is transferred over SMB or HTTP. Each object counted increments for either type of traffic.