Use the commands in this section in the broker CLI to view statistics and analysis results for the submissions the IVX cluster processed.
Note
This section describes the basic form of the commands. For a full list of commands and their usage, see the CLI Command Reference.
Viewing submission statistics
Use the following commands (or a variation of them) to view submission statistics:
show mvx submission—Statistics about all submissions the cluster processed.show mvx submission from—Statistics about submissions the cluster processed during the specified time period.show mvx submission <sensor-id>—Statistics about submissions from the sensor with the specified ID.show mvx submission since—Statistics about submissions since the specified date and time.
Viewing analysis results
Use the following commands (or a variation of them) to view analysis results:
show mvx submission done—Analysis results for all submissions the cluster processed.show mvx submission limit—Analysis results for the most recent specified number of submissions the cluster processed.show mvx submission malicious—Analysis results for malicious submissions the cluster processed.show mvx submission md5sum—Analysis results for submissions with the specified MD5 hash.show mvx submission sha256—Analysis results for submissions with the specified SHA-256 hash.show mvx submission uuid—Analysis results for submissions with the specified universally unique identifier (UUID).
Examples
The following example shows statistics for all submissions the cluster processed.
vx-1 # show mvx submission Runtime Cluster Stats: Total queued: : 0 Total running: : 0 Cluster Utilization : 0% MVX Submission Stats: Total urls : 613 Total files : 1251 Total submissions : 1864 Completed submissions : 1864 Malicious submissions count : 10 The following example shows statistics for submissions the MVX cluster processed from July 1, 2017 to July 8, 2017. vx-1 # show mvx submission from 2019/07/01 12:00:00 to 2019/07/08 12:00:00 Runtime Cluster Stats: Total queued : 0 Total running : 3 Cluster Utilization : 2% MVX Submission Stats: Total urls Total files : 289 Total submissions : 1216 Completed submissions : 1505 Malicious submissions count : 8 The following example shows statistics for submissions the cluster processed in the last 5 1/2 days. vx-1 # show mvx submission since 5 days 12 hours Runtime Cluster Stats: Total queued : 0 Total running : 0 Cluster Utilization : 0% MVX Submission Stats: Total urls : 747 Total files : 1455 Total submissions : 2202 Completed submissions : 2201 Malicious submissions count : 18 The following example shows the analysis results for the two most recent submissions. vx-1 # show mvx submission limit 2 Sensor ID : 001XXX... UUID : 289XXXX-XXXX... Insert time : 2019-07-11T22:27:02.841901 Start time : 2019-07-11T22:19:18.392246 Complete time : 2019-07-11T22:17:49.425406 Error Code : SUCCESS Sensor Sub ID : 2076 Malicious : NO Riskware : NO Files Analyzed : 1 Overall weight : 0 Analysis Object Name : SDFixCapcity.exe Start Time : 2019-07-11T22:17:49.425406 SHA256 : 1XXX... MD5SUM : 2XXX... File Type : exe Static Analysis Weight : 80 Dynamic Analysis Weight : 0 Child : NO Sensor ID : 002XXX... UUID : 364XXXX-XXXX... Insert time : 2019-07-11T22:26:47.814274 Start time : 2019-07-11T22:17:38.337658 Complete time : 2019-07-11T22:17:34.412521 Error Code : STATIC_ANALYSIS_ONLY Sensor Sub ID : 2073 Malicious : NO Riskware : NO Files Analyzed : 2 Overall weight : 0 Analysis Object Name : home.aspx Start Time : 2019-07-11T22:17:34.412521 SHA256 : 3XXX... MD5SUM : 4XXX... File Type : gz Static Analysis Weight : 0 Dynamic Analysis Weight : 0 Child : NO Analysis Object Name : file Start Time : 2019-07-11T22:17:34.412521 SHA256 : 5XXX... MD5SUM : 6XXX... File Type : htm Static Analysis Weight : 0 Dynamic Analysis Weight : 0 Child : YES
Output fields
Field | Description |
|---|---|
Total queued | Total number of submissions in the MVX engine queue waiting to be pulled by a compute node. |
Total running | Total number of submissions that are currently running. |
Cluster Utilization | Cluster utilization, displayed as a percentage of capacity. |
Total files | Total number of files submitted. |
Total submissions | Total number of submissions. |
Completed submissions | Total number of submissions that completed analysis. |
Malicious submissions count | Total number of submissions that were detected as malicious. |
Sensor ID | Appliance ID of the sensor or hybrid appliance. |
UUID | Unique universal identifier for the submission. |
Insert Time | The date and time the submission was added to the MVX engine queue. |
Start Time | Date and time the analysis began. |
Complete Time | Date and time the analysis ended. |
Error Code | Status of the analysis. Some common error codes follow:
|
Sensor Sub ID | ID that the sensor assigned to the submission. |
Malicious | Whether the submission was detected as malicious. |
Riskware | Whether the submission was detected as riskware. |
Files Analyzed | Number of files in the submission. |
Overall weight | Weight that is assigned to the submission based on a set of rules and what the MVX engine detected during analysis. |
Analysis Object Name | Name of the file that was analyzed. |
Start Time | Date and time the analysis began. |
SHA256 | SHA-256 checksum of the file. |
MD5SUM | MD5 checksum of the file. |
File Type | Type of file that was analyzed. |
Static Analysis Weight | Weight that is assigned to a static analysis job on a particular object. |
Dynamic Analysis Weight | Weight that is assigned to a dynamic analysis job on a particular object. |
Child | Whether the object is contained in another object, such as a PDF file in a ZIP file. |