Use the CLI show alerts hosts timeframe <start_time> <end_time> command to display the list of all triggered alerts in a specified time frame, ordered by host. Enter the start time (required) in N<h|d|m> format, where N is a number, h is hour, d is day, and m is month. For example, 24h is 24 hours. Enter the end time (optional) is in N<h|d|m> format. If you do not enter an end time the time frame will run from the start time to the present time.
Prerequisites
Administrator or Operator access to the Network Security appliance
Go to the CLI enable mode.
hostname > enable
Enter the command
show alerts hosts timeframe <start_time> <end_time>:hostname # show alerts hosts timeframe <start_time> <end_time>
Examples
The following example displays the list of alerts for the past hour ordered by host.
hostname # show alerts hosts 1h SrcIP Severity #Inf #Cb #Blkd Time Last Malware ----------------------------------------------------------------------------- 10.8.138.246 minor 1 0 0 2019-01-25 10:38:55 Exploit.Kit.Malvertisement 10.11.141.50 critical 0 1 0 2019-01-25 10:14:02 Trojan.Cutwail 10.12.193.32 critical 1 5 0 2019-01-25 10:43:59 Trojan.Downloader.Bredolab 10.21.142.151 critical1 1 0 2019-01-25 10:18:27 Exploit.Kit.URL 10.37.242.92 critical 3 5 0 2019-01-25 10:22:00 Exploit.Kit.URL 10.38.197.201 minor 1 0 0 2019-01-25 11:00:40 Exploit.Kit.Redirect ...
The following example displays the list of alerts host for the day before yesterday, ordered by host.
hostname # show alerts hosts 2d 1d SrcIP Severity #Inf #Cb #Blkd Time Last Malware ----------------------------------------------------------------------------- 10.1.131.205 critical 0 2 0 2019-01-26 20:26:46 Trojan.NaviPromo 10.1.141.37 minor 1 1 0 2019-01-26 21:56:07 Trojan.Ngrbot.DNS 10.2.67.118 critical 0 1 0 2019-01-26 19:14:42 Tool.CoinMiner 10.2.70.112 minor 0 1 0 2019-01-26 20:28:39 Trojan.Ngrbot.DNS 10.2.91.111 critical 0 1 0 2019-01-26 19:58:37 Trojan.Generic 10.2.135.116 critical 0 8 0 2019-01-27 04:00:20 Virus.Virut ...