Wildfire Activation

rrau — Fri, 21 Mar 2014 13:36:50 GMT

I successfully actived Wildfire in my environment..however, no data is being pushed to my external syslog server (Splunk) or the online Wildfire portal. Is there a sample file I can download to test if its working?

Re: Wildfire Activation

jdelio — Fri, 21 Mar 2014 14:09:48 GMT

We will assume that you have licensed and configured wildfire to work properly.. check the following doc if you need to verify:

How to Configure Wildfire

Please remember to set the file types to "PE" (Portable Executable)

If you need to check on the Wildfire functionality, you can run through a couple of commands to do so:

Once the basic configuration is complete, the following command provides the details of the best server selected:

> test wildfire registration

To verify, if any files have been forwarded to the server, enter the following command:

> show wildfire status

To view the count of how many PE files have been checked, found to be clean or uploaded, issue the command:

>show wildfire statistics

This information was in this doc:

How to Check the Connectivity to Wildfire and Upload Status of Files

Once you have this configured properly, you can test with any .exe file.

There are test eicar virus files that you can download and test (as far as the Anti-virus doesn't catch the file first).

Here is link to the Eicar.com website to download test files in many different ways.

http://www.eicar.org/85-0-Download.html

Please let us know if this helps.

Re: Wildfire Activation

kdd — Fri, 21 Mar 2014 14:10:09 GMT

Hi rrau,

on this site http://www.eicar.org/85-0-Download.html (you can also google for the eicar-testfile). This file should trigger a log-entry.

Cheers Klaus

topic Wildfire Activation in General Topics

Wildfire Activation

Re: Wildfire Activation

Re: Wildfire Activation