topic Re: Question about threat logs - Type wildfire-virus in General Topics

Question about threat logs - Type wildfire-virus

Hithead — Wed, 19 Aug 2015 14:26:03 GMT

Hi all,

just wondering why I see in our threat logs entries with the type wildfire-virus only for the application smtp...

(I would like to post some screenshots, but I cant find the upload button?)

What is the type wildfire-virus standing for? And where can I enable it for other applications as well?

Re: Question about threat logs - Type wildfire-virus

prb — Thu, 20 Aug 2015 12:14:12 GMT

Hi @Hithead,

wildfire-virus is a subtype used for wildfire signatures delivered using wildfire signature database, to differentiate from regular anti-virus signatures.

In short,

AV signatures are identified using subtype virus.

Wildfire signatures are identified using subtype wildfire-virus.

Hope this helps.

Thank You.

Re: Question about threat logs - Type wildfire-virus

Hithead — Thu, 20 Aug 2015 12:24:22 GMT

thank you very much vor your response.

But I'm still wondering, why I see wildfire-virus logs only in combination with smtp... I guess wildfire-virus should also track and identify threats on other protocols/applications as well...

Re: Question about threat logs - Type wildfire-virus

prb — Thu, 20 Aug 2015 12:47:50 GMT

Hi @Hithead

Sure it should inspect traffic from other decoders as well.

Wildfire action is set using the highlighted column in anti-virus profile.

You might need to check lot of other factors -

1. What is the action for other decoders than smtp?

2. The policy to which the AV profile is applied. Does it process other kind of traffic?

3. If it does, do the other traffic actually carry any threat data?

4. Do you have any exceptions applied under applications tab in the screenshot above?

Etc.

Thank You.

Re: Question about threat logs - Type wildfire-virus

Hithead — Thu, 20 Aug 2015 13:32:56 GMT

1. What is the action for other decoders than smtp?

Action: all block; WildFire Action: all block

2. The policy to which the AV profile is applied. Does it process other kind of traffic?

no diffrent AV profile is used between other rules. but the policy for smtp only allow smtp (app-default) traffic.

3. If it does, do the other traffic actually carry any threat data?

threat data on other policies are there (except wildfire-virus)

4. Do you have any exceptions applied under applications tab in the screenshot above?

nope