topic Info Wildefire analysis and wildefire in antivirus profile in General Topics

Info Wildefire analysis and wildefire in antivirus profile

Gianpiero — Tue, 31 Jan 2017 11:26:24 GMT

Hai all

after the upgrade to new version of pan os(7.0.13) i found some difference in security profile. Can you help me to understand the difference between:

- Security Profile > Antivirus > wildefire action

- Security Profile > Wildefire Analysis

is Antivirus profile to block malicious file knew in the dat file and wildefire for zero day files?Why there is a second wildefire profile in the Antivirus profile?If i make a rule which profile must i apply to the rule?

Thanks all

Gianpiero

Re: Info Wildefire analysis and wildefire in antivirus profile

reaper — Tue, 31 Jan 2017 13:20:23 GMT

hi there

there's 2 parts to Wildfire: one it the uploading and analyzing of files, which return you a verdict for that file

the second part is creating a signature to block these files for everyone that has downloaded the dynamic update package

so - Security Profile > Antivirus > wildefire action : is which actions to take on signatures matching the wildfire content update

it requires you to have the separate wildfire license

and - Security Profile > Wildefire Analysis : is what you want to do with files going through the firewall - upload them to wildfire or not

hope this makes sense ?

Re: Info Wildefire analysis and wildefire in antivirus profile

sullivanpj2 — Tue, 31 Jan 2017 13:23:19 GMT

If I remember correctly, the AV profile allows you to set actions (reset-client, reset-server, etc) based on the decoder (http, ftp, pop3, etc). The Wildfire Analysis profile allows you to set which files you want to upload to the wildfire engine (public or private).

https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/policy/antivirus-profiles#19476

https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/policy/wildfire-analysis-profiles.html

Hope that helps!

- Peter