https://live.paloaltonetworks.com/t5/advanced-threat-prevention/understanding-wildfire-logs/m-p/232131#M418 <P>This is expected behavior and by design.</P> <P>&nbsp;</P> <P>Informational - the threat (file) was blocked by a Wildfire-virus signature and therefore the firewall alerts the admin at an informational level because the threat was mitigated.</P> <P>&nbsp;</P> <P>High - the threat (file) was passed by the firewall and not blocked by a Wildfire-virus or Antivirus signature.&nbsp; This could be due to the configuration or due to the fact that a virus signature to detect and block the file does not exist.</P> <P>&nbsp;</P> <P>You can derive additional context by also reviewing the corresponding Threat logs relevant to the two Wildfire log entries in your screenshot.</P> Mon, 24 Sep 2018 18:47:00 GMT bvandivier 2018-09-24T18:47:00Z https://live.paloaltonetworks.com/t5/advanced-threat-prevention/understanding-wildfire-logs/m-p/232129#M417 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/16753i6BBECE0E374A0671/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="image.png" alt="image.png" /></span>This screenshot is from the wilfire tab. Why I see this informational block and high alert.</P> Mon, 24 Sep 2018 18:40:30 GMT https://live.paloaltonetworks.com/t5/advanced-threat-prevention/understanding-wildfire-logs/m-p/232129#M417 raji_toor 2018-09-24T18:40:30Z https://live.paloaltonetworks.com/t5/advanced-threat-prevention/understanding-wildfire-logs/m-p/232131#M418 <P>This is expected behavior and by design.</P> <P>&nbsp;</P> <P>Informational - the threat (file) was blocked by a Wildfire-virus signature and therefore the firewall alerts the admin at an informational level because the threat was mitigated.</P> <P>&nbsp;</P> <P>High - the threat (file) was passed by the firewall and not blocked by a Wildfire-virus or Antivirus signature.&nbsp; This could be due to the configuration or due to the fact that a virus signature to detect and block the file does not exist.</P> <P>&nbsp;</P> <P>You can derive additional context by also reviewing the corresponding Threat logs relevant to the two Wildfire log entries in your screenshot.</P> Mon, 24 Sep 2018 18:47:00 GMT https://live.paloaltonetworks.com/t5/advanced-threat-prevention/understanding-wildfire-logs/m-p/232131#M418 bvandivier 2018-09-24T18:47:00Z