topic Wildfire Submissions in Advanced Threat Prevention Discussions

Wildfire Submissions

MikeSchrader — Thu, 02 Feb 2023 14:11:20 GMT

I have a couple questions concerning Wildfire which I can't find the exact answers in any of the knowledge articles.

1. Is the entire file or email attachment sent to the WF cloud or just a sample/hash? Online I've seen both statements but can't confirm.

2. After the file is sent to the WF cloud for inspection, what does WF do with that file? Do they discard it or is it maintained? I have a customer wanting to implement WF in their environment but is concerned about the life of files sent to the WF cloud.

Re: Wildfire Submissions

Raido_Rattameister — Thu, 02 Feb 2023 14:49:41 GMT

1. Entire file.

2. If it is found to be benign then it will be purged after 14 days. If it is malicious then 10 years.

First Palo takes hash of the file and sends only hash.

If WildFire has seen this file before then verdict comes back right away.

If WildFire has not seen file with this hash before then whole file is uploaded to be scanned in sandbox.

https://docs.paloaltonetworks.com/wildfire/u-v/wildfire-whats-new/latest-wildfire-cloud-features/updated-wildfire-retention-period