topic Re: how to configure wildfire to block a malicious file? in General Topics

how to configure wildfire to block a malicious file?

thanachaip — Mon, 24 Feb 2014 16:11:50 GMT

i used PA3020 and software version 6.0.0, wildfire version is 26818-33137

i configured wildfire action to block in antivirus profile and apply to security policy already.

but, when i test to download a malicious files. the action is alert and i can download this file. why?

i don't know, what is wrong in my configure and i want to know, how to configure wildfire to block a malicious file.

Re: how to configure wildfire to block a malicious file?

VinceM — Mon, 24 Feb 2014 16:55:45 GMT

Hi,

What about the wildfire report for your virus.exe file ?

Re: how to configure wildfire to block a malicious file?

Mystique — Mon, 24 Feb 2014 19:00:42 GMT

Do you have a configured file blocking profile ? What is the action set for the file blocking profile under objects ?

Re: Re: how to configure wildfire to block a malicious file?

thanachaip — Mon, 24 Feb 2014 19:00:43 GMT

Hi,VinceM

this's wildfire analysis report.

Re: Re: how to configure wildfire to block a malicious file?

thanachaip — Mon, 24 Feb 2014 19:03:34 GMT

@hparikh

i configured action in blocking profile to "forward".

Re: how to configure wildfire to block a malicious file?

Mystique — Tue, 25 Feb 2014 04:35:14 GMT

Wildfire report shows that the first time the malware was reported at 02-24 14:08 and the log shows alert for type wildfire at 22:59 with wildfire-upload-skip since the file has been already sent to wildfire cloud

If the firewall is equipped with a WildFire subscription then it can receive the new signatures within 30-60 minutes; firewalls with only a Threat Prevention subscription can receive the new signatures in the next antivirus signature update within 24-48 hours. Can you please confirm if you have valid license for wildfire? The wildfire version that you have is 26818-33137 and the latest available is 26836-33168.

Re: how to configure wildfire to block a malicious file?

thanachaip — Tue, 25 Feb 2014 04:45:14 GMT

i try to test this virus.exe about 4 hours. and i download an update already.

and if you look at this pic. wildfire log is show "virus.exe" is malicious but action is alert, not block.

Re: Re: how to configure wildfire to block a malicious file?

mg_imid — Wed, 26 Feb 2014 04:34:53 GMT

Hi thanachaip,

Nothing false in your configuration.

I got the same problem and already open case for it.

Re: how to configure wildfire to block a malicious file?

HULK — Wed, 26 Feb 2014 05:00:27 GMT

Could you please share the case ID here.

Re: how to configure wildfire to block a malicious file?

mg_imid — Wed, 26 Feb 2014 06:40:23 GMT

Hi HULK,

My case number : 00189573.

Re: how to configure wildfire to block a malicious file?

JayD — Fri, 27 Jun 2014 10:40:09 GMT

Hi Hulk,

Not sure if there was a resolution to this issue but I am having the exact same issue and am getting nowhere with support.

Case ID: 00226681

Hoping maybe you can help?

Re: how to configure wildfire to block a malicious file?

Antwoinne — Tue, 01 Jul 2014 15:30:51 GMT

Also having this same issue with a PA3020 running version 6.0.2 currently. Any new information?

Re: how to configure wildfire to block a malicious file?

JayD — Tue, 01 Jul 2014 17:03:31 GMT

I finally got my case escilated and am currently working on getting them more info. Will update when I know more.

Re: how to configure wildfire to block a malicious file?

Antwoinne — Thu, 10 Jul 2014 16:38:19 GMT

Thanks JayD, looking forward to hearing more

Re: Re: how to configure wildfire to block a malicious file?

pulukas — Thu, 10 Jul 2014 16:44:25 GMT

Antwoinne If you can, please create a ticket with your example and reference JayD 's Case ID: 00226681 when you do.

This will give support more data to work with for a solution.

Thanks for posting the information and tracking the issue for the rest of us.

Re: Re: how to configure wildfire to block a malicious file?

Antwoinne — Thu, 10 Jul 2014 17:05:48 GMT

This issue was handled by our internal managed support team, escalated to me for assistance and then escalated to PAN with a case opened. I provided them JayD 's Case ID for that very tracking capability. I'm trying to retrieve our PAN Case ID now so it can be listed here.

Re: how to configure wildfire to block a malicious file?

paloalto_exn — Fri, 07 Nov 2014 13:04:24 GMT

Hello,

does anybody fixed that?

I am experiencing the same issue..

regards.

Walter Doria

Re: how to configure wildfire to block a malicious file?

markk96 — Sun, 09 Nov 2014 03:03:48 GMT

I have the same issue. Any update?

Re: how to configure wildfire to block a malicious file?

kevin_thys — Tue, 24 Mar 2015 11:08:34 GMT

Hi,

The WF signature database on the devices don't have all signatures. So if your file is malicious that indicates a file was inspected by WF and with hash check your firewalls knows this verdict.

But to block the file it needs to have a signature in the WF database on your device. If the algorithm to select signatures being in the WF database not selected the signature for your file, your device will not be able to block it.

If the file is triggered the WF algorithm will select the file again to be in the WF database that is pushed towards the devices in one of the next updates. Then you will see it gets blocked.

That is how it works in fact, of course a bug is also possible

Regards,

Kevin