9.2.3. Procedure to analyse the engines monitoring

9.2.3.1. Introduction

This procedure enables displaying the status of the various analysis engines and the actions to be taken.
The graphical interface is described in the `Analysers` screen of the Web UI.

9.2.3.2. Prerequisites

User: member of Administrators Group

9.2.3.3. Preliminary operations

9.2.3.4. How to access the `Analysers` screen

When the `Analysers` command is pressed, the following screen is displayed.

../../_images/GBOX_ANALY_01.PNG

Marker

Engine

Engine function

1

Grip engine

Static analysis

2

Goasm engine

Shellcode detection

3

Gdgadetect engine

Domain name detection

4

Gnest engine

Dynamic analysis within a virtual machine

5

Gmalcore engine

Static and heuristic analysis

The following information is displayed for each engine:

../../_images/GBOX_ANALY_02.PNG

Marker

Name

Grip Engine

Goasm Enging

Gdgadetect Enging

Gnest Engine

Gmalcore Engine

1

Type

Static analysis

Shell code detection

Detection of domain names generated by the Domain Generation Algorithm (DGA)

Executes the file in a virtual machine and analyses its behaviour

Static and multi-engine heuristic analysis

2

Capabilities

Analysis

Provides a score for the potential danger and names the shellcode detected

Provides a compromise score

Names the problem detected

Provides a score for the potential danger and names the problem detected

3

Config

Not configurable, so this field is not displayed

Virtual machine management - adding, deleting, logging

Gmalcore engine management

4

x jobs : number of tasks in progress (analysis status NEW + IN PROGRESS)

Number of jobs awaiting processing

5

Ability to carry out analyses

This engine has no requirements, so it is always in the `ready` state.
The engine is in the `ready` state if there is the same number of VMs in the GBox.
and in CAPE - the dynamic analysis engine
The engine is in the `ready` state if all the engines are installed.
and the API is up

6

Engine status

UP : engine api is listening : DOWN : engine api is not active
When the `Analysers` command is pressed, the following screen is displayed.
../../_images/GBOX_ANALY_01.PNG

Marker

Engine

Engine function

1

Grip engine

static analysis

2

Goasm engine

Shellcode detection

3

Gdgadetect engine

Domain name detection

4

Gnest engine

Dynamic analysis in a virtual machine

5

Gmalcore engine

Static and Heuristic Analysis

The following information is displayed for each engine:

../../_images/GBOX_ANALY_02.PNG

Marker

Name

1

Type

2

Capacities

3

Config, only available for certain engines

4

x jobs

5

Status

6

Engine status

9.2.3.5. Procedure for checking that engines are in good condition

  • Check whether each motor is in the `UP` status.

Astuce

If the engine status (Grip, Goasm, Gdgadetect or Gnest) is `DOWN`, wait a moment.
If the engine remains in the `DOWN` status, contact Gatewatcher support.

  • Check whether each motor is in the `Ready` status.

Astuce

`Not Ready` status for the Gmalcore engine does ** not necessarily indicate that the engine is unable to perform scans, but it does indicate that at least one of the 16 antivirus engines is out of date or out of service.

9.2.3.6. Procedure for updating Gnest and Gmalcore engines

Signature updates or updates represent updates to the GBox detection engines.
There are 3 types of update packages:

  • Gmalcore packages (latest_malcore): these packages only contain updates to the antivirus engines and databases used by Malcore.

  • Sandbox packages (latest_sandbox): these packages contain updates to the signatures and modules used by the Gnest engine sandboxes.

  • Complete packages (latest_full): these packages are a combination of the two previous packages.

These packages can be installed: