topic File search by hash sum in General Topics

File search by hash sum

Interface — Mon, 19 Aug 2013 13:57:57 GMT

Hi,

Can the PaloAlto firewall search for files using hash sum (chechsum)?

Re: File search by hash sum

kprakash — Mon, 19 Aug 2013 14:16:10 GMT

Hi Ignas,

The PANFW does look for the hash of the files when using wildfire for file blocking functionality.

The below docs explain the same:

https://live.paloaltonetworks.com/docs/DOC-3300

https://live.paloaltonetworks.com/docs/DOC-5266

https://live.paloaltonetworks.com/message/13942#13942

Re: File search by hash sum

Interface — Tue, 20 Aug 2013 05:39:57 GMT

Hi kprakash,

thanks for your answer. I want to know, if i have exact file packet checksum, can i find all packets in my network which match that checksum? As i understand, PaloAlto don't have such possibility.

Re: File search by hash sum

VinceM — Tue, 20 Aug 2013 08:39:17 GMT

Hi,

No, you can't. Neither the Sha256 checksum used for wildfire nor other checksum are available as usable criteriun.

Hope help