topic Re: Wildfire flow in General Topics

Wildfire flow

Retired Member — Sat, 21 Sep 2013 12:53:00 GMT

Hi,

For the desicion flow of wildfire, where is the hash update and wildfire database update ? can someone tell the real place of both in that chart.

Document's very clear but it is written before subscription service was released.

WildFire Decision Flow

Re: Wildfire flow

shasnain — Sat, 21 Sep 2013 16:06:23 GMT

Hi,

When users download .exe or .dll files, PA computes the hash of the file and send only computed hash to the wildfire cloud. Then in the cloud, this hash is compared with the hash base which is maintained by palaltonetworks. If the hash matches, then the verdict is known and file is not uploaded to the cloud, if hash do not match then the file is uploaded and inspected and you can see the file on the portal. Also if the hash on the PA doesnt match with the hash database in the cloud, it creates a new virus id for the file.

Thanks,

Syed R Hasnain

Re: Wildfire flow

mikand — Sun, 22 Sep 2013 10:47:37 GMT

Are uploaded files stored somewhere within this "cloud" to be re-evaluated on a schedule?

Im thinking when PA is changing what will trigger a file to be considered malware or not (like the case I found a few months ago where wildfire verdict was benign but the file was truly a very bad file) - then this "the hash matches a clean file" might not be true...

Also is there a setting regarding this within WF-500, for example making a verdict for a specific hash only valid for 24 hours or so - if the file is seen again later on then the file will be re-evaluated?