topic Re: Wildfire - Connection hold in General Topics

Wildfire - Connection hold

TheRealDiz — Wed, 11 Jan 2017 17:07:17 GMT

Hi all,

Just a question:

I didn't understand Wildfire mechanism related to a single session.

Is there a connection hold when waiting for a response (benign, malicious) from PA cloud by default? Is that configurable?

If the answer is Yes, but where?

Best Regards

Luca A. Di Leo

Re: Wildfire - Connection hold

reaper — Thu, 12 Jan 2017 14:21:31 GMT

Hi @TheRealDiz

no the session is not held

if a file is received one of 3 actions can happen

file known malicious: blocked based on signature that was created prior

file known benign: file is passed through, benign logging is added (if benign logging is enabled)

file unknown: session is allowed to pass, file is grabbed and uploaded to WildFire for analysis, file is analysed and afterward the verdict is attached to the logging. if malicious: signature is created and rolled out to all WildFire customers

Re: Wildfire - Connection hold

TheRealDiz — Fri, 13 Jan 2017 09:03:24 GMT

Hi @reaper,

You are always on point, thanks a lot for your quick response.

So in conclusion, is this mechanism not configurable?

Thanks again

Luca

Re: Wildfire - Connection hold

reaper — Fri, 13 Jan 2017 11:49:57 GMT

Hi @TheRealDiz

that's right, thre is no holding mechanism pending a verdict

i looked it up and there is already a feature request : FR2833

please reach out to your local sales team and have them add your vote 🙂

Re: Wildfire - Connection hold

TheRealDiz — Fri, 13 Jan 2017 12:14:33 GMT

Many Many thanks,

Infact I didn't find anything related to this argument inside Wildfire's documentation.

Have nice day! 🙂