Wildfire detecting phishing (severity high) but action is allow

ccfritz — Mon, 22 Aug 2022 18:29:51 GMT

Hello all, I am seeing multiple Wildfire submissions that have the same source IP

and are being detected as smtp-base with the verdict of phishing, high severity but the

action is "Allow". I have noticed in the Antivirus profile that for SMTP the "Wildfire

signature action" and the Wildfire Inline ML action" is set to "default (alert)". How do I block

these Wildfire detections that are phishing and Malicious? Thank you.

Re: Wildfire detecting phishing (severity high) but action is allow

nikoolayy1 — Wed, 31 Aug 2022 09:47:11 GMT

Well just set it to block not alert. Palo Alto has great documentation so for such questions you will get the answer with google in matter of minutes:

https://docs.paloaltonetworks.com/wildfire/u-v/wildfire-whats-new/latest-wildfire-cloud-features/wildfire-phishing-verdict

topic Re: Wildfire detecting phishing (severity high) but action is allow in Next-Generation Firewall Discussions

Wildfire detecting phishing (severity high) but action is allow

Re: Wildfire detecting phishing (severity high) but action is allow