topic Re: wildfire is not reporting in the wildfire submission in Next-Generation Firewall Discussions

wildfire is not reporting in the wildfire submission

MRamadanAHafiez — Thu, 05 Sep 2024 12:22:03 GMT

Hello Friends,

I have configured the paloalto wildfire feature:

- kept the default file settings in Device --> wildfire --> General settings.

checked Report Benign Files, and grayware files too.

- created a wildfire profile that contains any apps, any file type, download direction, public cloud in the Objects --> wildfire analysis.

- in the antivirus profiles used I have enabled "Hold for WildFire Real Time Signature Look Up" with action or all application to reset-both in wildfire signature based action and inline machine learning action too.

- applied the profile on all security roles.

knowing that we have decrypted and non decrypted networks, when I use paloalto test https://docs.paloaltonetworks.com/advanced-wildfire/administration/configure-advanced-wildfire-analysis/verify-wildfire-submissions/test-a-sample-malware-file

in both cases with or without ssl decryption no logs at all in the wildfire submissions.

Software Version 11.1.2-h3

Any help, TIA

Re: wildfire is not reporting in the wildfire submission

Claw4609 — Fri, 06 Sep 2024 15:47:10 GMT

Hello,

If you log into the wildfire cloud do you see items there? Dashboard-WildFire Portal (paloaltonetworks.com)

Are you viewing these logs on the firewall itself or in Panorama? Do you have a log forwarding profile set with Wildfire log type to be sent somewhere?

Re: wildfire is not reporting in the wildfire submission

MRamadanAHafiez — Fri, 06 Sep 2024 16:57:16 GMT

Thank you @Claw4609 for the reply, i have cheched the portal and no files at all previous hour or 24 hours.

I am using the firewall no panorama.

No log forwarding profile for the wildfire logs.

Re: wildfire is not reporting in the wildfire submission

Claw4609 — Fri, 06 Sep 2024 18:27:56 GMT

Within the CLI whats the output of "show wildfire status"? Are you just pointed to the wildfire public cloud? Does your firewalls MGMT interface have internet access and can you ping wildfire.paloaltonetworks.com from your firewalls MGMT interface? And if you look at the traffic logs do you see the app-id "paloalto-wildfire-cloud"?

Re: wildfire is not reporting in the wildfire submission

MRamadanAHafiez — Sat, 07 Sep 2024 06:57:19 GMT

Thank you @Claw4609 so much.

it was issue of applications allow, as soos as i allowed the paloalto wilfire cloud app, it started working.

thank you again 🙂