topic Block grayware files? in Advanced Threat Prevention Discussions

Block grayware files?

CRDF18 — Wed, 31 Oct 2018 13:33:56 GMT

We have recently had a few grayware alerts come through and i was wondering is there anyway files marked as grayware in WIldfile could be blocked the same as they are for malicious files?

Thanks

Re: Block grayware files?

OtakarKlier — Wed, 31 Oct 2018 14:43:00 GMT

Hello,

I dont know of a way to do it on the PAN itself. However looks like if you have traps. it can.

https://www.paloaltonetworks.com/documentation/34/endpoint/newfeaturesguide/malware-protection-features/malware-remediation/grayware-verdict-support

You can always submit a feature request to your SE.

Regards,

Re: Block grayware files?

CRDF18 — Wed, 31 Oct 2018 15:45:21 GMT

Thanks, i did do a little research before posting on here and all i could see was Traps related stuff but unfortunatly we dont have Traps, so i might have to request it a feature

Re: Block grayware files?

mivaldi — Wed, 31 Oct 2018 16:44:08 GMT

There is no Antivirus signature generation for grayware files.

Re: Block grayware files?

CRDF18 — Thu, 01 Nov 2018 09:40:09 GMT

yup i read that as well haha

I was just hoping that the firewall can alert you its grayware it could then give you the option to block it but it seems it cant. Im also looking at our endpoint protection as well as this should step in to help it out

Re: Block grayware files?

mivaldi — Thu, 08 Nov 2018 19:53:45 GMT

Yes, Traps can be configured to block files marked as grayware by WildFire through Hash Control.