wildfire testing

Alex_Samad — Sun, 25 Jun 2017 23:59:06 GMT

I tried downloading this

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Test-WildFire-with-a-Fake-Malicious-File/ta-p/60925

It shows up as being submitted to wildfire, but doesn't get blocked. is that the right action ?

Re: wildfire testing

acc6d0b3610eec313831f7900fdbd235 — Mon, 26 Jun 2017 00:52:40 GMT

The Wildfire PE test file is only to proof that the firewall is able to identify unknown hashes and forward it to the Wildfire cloud. An AV signature is not created for it.

For samples that the firewall detects, the firewall checks the sample hash against WildFire signatures to determine if WildFire has previously analyzed the sample. If the sample is identified as malware, it is blocked. If the sample remains unknown after comparing it against existing WildFire signatures, the firewall forwards the sample for WildFire analysis.

In other words, the prevention action (Block) only occurs after the Wildfire convicts a file as being malicious, when it then generates and AV signature.

https://www.paloaltonetworks.com/documentation/70/wildfire/wf_admin/wildfire-overview/wildfire-concepts.html

I hope this helps

topic Re: wildfire testing in General Topics

wildfire testing

Re: wildfire testing