smb-detect (APT defense profile view)

Function

The smb-detect command enables file reputation detection for SMB.

The undo smb-detect command disables file reputation detection for SMB.

Format

smb-detect direction { both | download | upload } [ action { alert | block } ]

undo smb-detect [ direction ] [ action ]

Parameters

Parameter	Description	Value
direction	Specifies the transmission direction of the files.	The direction can be one of the following (the default direction is both): both: Indicates that files in the upload and download directions are inspected. download: Indicates that files in the download direction are inspected. upload: Indicates that files in the upload direction are inspected.
action	Specifies the response action.	The response action can be either of the following (the default action is block): alert: The system permits files and generates logs. block: The system terminates sessions and generates logs.

Views

APT defense profile view

Default Level

2: Configuration level

Usage Guidelines

By default, file reputation detection is enabled for SMB.

The default action is block.

Example

# Create a profile named apt_smb, set the SMB file transfer direction subject to file reputation detection to upload, and set the action to alert.

<sysname> system-view
[sysname] profile type aapt name apt_smb
[sysname-profile-aapt-apt_smb] smb-detect direction upload action alert