topic Re: Trouble differentiating between malware already seen by WildFire and malware 'first seen' by Wil in General Topics

Trouble differentiating between malware already seen by WildFire and malware 'first seen' by WildFire

r_gine — Thu, 06 Aug 2015 15:45:09 GMT

I'm having trouble determining which malware has already been seen by WildFire (therefore it was not re-sent for analysis and blocked by the FW) vs. a file that our organization sent to WF and was determined to be malicious after analysis (not seen before by WF) . This would significantly help our organization respond to malicious files that may have made it to internal systems (mail servers, desktop, etc). Right now, I go into the analysis report and look at the first seen date... I know there's a better way.

Thanks!

Re: Trouble differentiating between malware already seen by WildFire and malware 'first seen' by WildFire

bmorris1 — Fri, 07 Aug 2015 20:49:26 GMT

Hello r_gine,

If a file has already been seen by wildfire then it will show as wildfire skip in the log.

Ben

Re: Trouble differentiating between malware already seen by WildFire and malware 'first seen' by WildFire

santonic — Mon, 10 Aug 2015 11:20:50 GMT

In Data Filtering log:

- action 'wildfire-upload-success' means file was first seen by your device,

- action 'wildfire-upload-skip' means file was already known to WF

Yes, unfortunately you need to look in 2 log files to see if it was malicious and if you were first to see it.

Re: Trouble differentiating between malware already seen by WildFire and malware 'first seen' by Wil

mvidic — Wed, 19 Aug 2015 06:08:59 GMT

In addition to what @santonic said, you should have a look at WildFire Submissions log. By default it will only display malicious files that were uploaded to the cloud, from which we can conclude that those files have not been previously seen by the WF cloud, were not blocked and made it through to your network.

You can also turn on option Device > Setup > Wildfire > Report benign files. With this option enabled Wildfire Submissions log wil also display Benign files which were uploaded to the cloud.