topic Re: Wildfire Email Alerts in General Topics

Wildfire Email Alerts

apackard — Fri, 29 Aug 2014 18:15:43 GMT

Hopefully quick one..

We used to get these alerts directly from the Wildfire cloud, but they have stopped (for a few months actually, I've only just got round to looking into it) - is this normal?

We do get the email alerts setup via the logging mechanism from the FW itself, but these do not contain all of the Wildfire specific information:-

Cheers

Re: Wildfire Email Alerts

HULK — Fri, 29 Aug 2014 19:27:41 GMT

Hello apackard,

Could you please log into the wildfire portal @ https://wildfire.paloaltonetworks.com/ and verify one more time, if notification has been enabled for the mentioned S/N ( PAN FW).

1- Go to Settings > enable the check-box for malware/benigh file notification ( for the required S/N)

2- Update notification.

FYI.

Thanks

Re: Wildfire Email Alerts

HITSSEC — Sat, 30 Aug 2014 01:50:53 GMT

Hello apackard,

We had a similar situation but it was caused as a result of our appliance not forwarding the files to the wildfire cloud. It is one of those things that if you don't get the email alerts you assume everything is OK. We ended up re-registering the device with wildfire and that started things back up. Not sure if this the same situation or not. What I would verify first is that you are actually forwarding files to the Wildfire Cloud and then check the notification settings as Hulk suggests in the previous reply.

Phil

Re: Wildfire Email Alerts

apackard — Thu, 11 Sep 2014 15:22:29 GMT

Many thanks all, and update.

I did (and do) have the alerts enabled in the portal. I ended up 're-enabling' by selecting the 'All' tick box and re-saving, then testing with the WF test PE and I did get an email after that test.

Everything looked OK at this point, but this morning I was reviewing my logs and noticed that WF triggered 5 times on malicious files trying to download (we were prompted to look as we have an AV alert from a PC) and I had not received an emails from WF.

As HITSSEC noted above, it is *incredibly* frustrating where you cannot rely on an alert coming through to initiate action...!

Re: Wildfire Email Alerts

HITSSEC — Sun, 14 Sep 2014 16:12:31 GMT

Apackard,

We have daily report that can be emailed to let you know that files are being sent to the Wildfire cloud. Se Below:

Sample output looks like this:

This reporting / monitoring on Wildfire will help you recognize that there may be an issue fairly soon as opposed to going days or weeks in the dark about the status of Wildfire connectivity from your appliance.

Hope this helps,

Phil

Re: Wildfire Email Alerts

mivaldi — Wed, 24 Sep 2014 00:13:07 GMT

For future reference, please check the following KB article:

WildFire Email Alerts: Subscribe or Add Additional Recipients

Best regards,

Mariano Ivaldi