topic Re: Wildfire verdict malicious and action alert in General Topics

Wildfire verdict malicious and action alert

COMIP — Wed, 05 Oct 2016 15:37:57 GMT

Hi all,

We have seen in Wildfire Submissions that all files identified as Malicious and Grayware the action is Alert. The Wildfire Profile is configures to forward to public cloud and Antivirus profile has reset-both in Wilfdire Action tab.

Is this a normal work?

This is the Wildfire Submission

Thanks a lot,

Jordi

Re: Wildfire verdict malicious and action alert

reaper — Thu, 06 Oct 2016 07:10:18 GMT

Hi Jordi

This is possible if the file has not been seen by wildfire before: if a file is known to be malware, the antivirus profile action will be applied, so if you configured the profile to block, it will block the file. this will be logged in the threat log.

if the file is not known yet, it will need to be sent to wildfire for analysis first. because the file transfer needs to complete for the entire file to be uploaded to the cloud, the session will not get blocked. once the upload is completed, a log is created to indicate the file was uploaded. since the log is to indicate an upload to the cloud, the action in the wildfire submission logs will always be alert

Re: Wildfire verdict malicious and action alert

COMIP — Thu, 06 Oct 2016 10:03:42 GMT

Hi,

Thanks for your answer.

I think that our wildfire is not working correctly or is bad configured. Is rare that all actions are alert, there are no one block.

I have do wildfire test with http://wildfire.paloaltonetworks.com/publicapi/test/pe.

With the first download Paloalto identify the file as malware and action is block

After 30 minutes and new wildfire updates I put the same file to ftp and the result continues malware and action alert

Wildfire profile is configured as forward to public-cloud and Antivirus profile is configured as block.

Thanks,

Jordi

Re: Wildfire verdict malicious and action alert

reaper — Thu, 06 Oct 2016 11:06:27 GMT

Hi Jordi

the test PE file will only allow you to verify if uploading and cloud analysis works for your deployment, it is not blocked as we don't generate signatures for the test file

also, in the wildfire submission log, action will always be alert (as it simply logs the upload), traffic and more specifically threat log will give you the action that was taken on the session itself (block)