Use the CLI commands in this topic to view the event queries using the CLI.
where IP address is the source address and destination address that you want to query.
Enable the CLI configuration mode.
hostname > enable
hostname # configure terminal
View the search results from a particular source IP address and destination IP address.
hostname (config) # show analysis summary by source IP address and destination IP address
The following sample output verifies the search results for malicious and nonmalicious objects and URLs from a particular source IP address and destination IP address:
hostname (config) # show analysis summary by source 172.16.8.87 and destination 172.16.1.11 Source IP Destination IP Checksum Occurred Time (UTC) Is Malicious URL ------------------------------------------------------------------------- 172.16.8.87 172.16.1.11 707dbb57d9d67214961eed30d48e6570 2014-10-01 04:36:55 No 172.16.1.11/~ywang/poc.doc
Enable the CLI configuration mode.
hostname > enable hostname # configure terminal
View the search results from a particular source IP address or destination IP address.
hostname (config) # show analysis summary by source IP address or destination IP address
where IP address is the source address or destination IP address that you want to query.
The following sample output verifies the search results for malicious and nonmalicious objects and URLs from a particular source IP address or destination IP address:
hostname (config) # show analysis summary by source 172.16.8.101 or destination 172.16.8.123 Source IP Destination IP Checksum Occurred Time (UTC) Is Malicious URL ----------------------------------------------------------------------------- -------------------- 172.16.8.192 172.16.8.123 25b975e090eca2ae7f22b3c078818266 2014-10-01 105:15:29 Yes 172.16.8.123:8080/metasploit/uaP.jar
Enable the CLI configuration mode.
hostname > enable hostname # configure terminal
View the search results from a particular source IP address.
hostname # show analysis summary by source IP address
where IP address is the source address that you want to query.
The following sample output verifies the search results for malicious and nonmalicious objects and URLs from a particular source IP address.
hostname (config) # show analysis summary by source 172.16.8.119 Source IP Destination IP Checksum Occurred Time (UTC) Is Malicious URL ----------------------------------------------------------------------------- -------------------- 172.16.8.119 172.16.8.180 cb31f25d491e1127e96b7c9e86f14bb2 2014-10-01 04:49:29 Yes 172.16.8.180/ywpwzp6eyFxw/jvm.dll
Enable the CLI configuration mode.
hostname > enable hostname # configure terminal
View the search results from a particular destination IP address.
hostname # show analysis summary by destination IP address
where IP address is the destination address that you want to query.
The following sample output verifies the search results for malicious and nonmalicious objects and URLs from a particular destination IP address:
hostname (config) # show analysis summary by destination 172.16.8.144 Source IP Destination IP Checksum Occurred Time (UTC) Is Malicious URL ----------------------------------------------------------------------------- -------------------- 172.16.8.200 172.16.8.144 ed615e865e88c021ba0e4d4f5f723426 2014-10-01 07:36:00 No 172.16.8.144/DAVtest/iacenc.dll
Enable the CLI configuration mode.
hostname > enable hostname # configure terminal
View whether the appliance has detected a particular URL.
hostname (config) # show analysis summary by URL string
where string is the URL that you want to query.
The following sample output verifies the search results for a particular URL:
hostname (config) # show analysis summary by URL sticky/~hsafyallah/poc.ppt Source IP Destination IP Checksum Occurred Time (UTC) Is Malicious URL ----------------------------------------------------------------------------- --------------------- 172.16.8.226 172.16.1.2 0f5a821095aa8fb8e2563cf327a94a72 2014-10-01 08:25:51 No sticky/~hsafyallah/poc.ppt
Enable the CLI configuration mode.
hostname > enable hostname # configure terminal
View whether the appliance has detected an object with the specified MD5 checksum.
hostname (config) # show analysis summary by checksum numeric value
where numeric value is the value of the specified MD5 checksum.
The following sample output verifies the search results for an object with the specified MD5 checksum:
hostname (config) # show analysis summary by checksum b7365b356692323931518577b122a4eb Source IP Destination IP Checksum Occurred Time (UTC) Is Malicious URL ----------------------------------------------------------------------------- -------------------- 172.16.8.132 172.16.1.2 b7365b356692323931518577b122a4eb 2014-10-01 06:52:07 No 172.16.1.2/~mdeonarine/poc.zip