topic Re: Wildfire Activity? in General Topics

Wildfire Activity?

OMatlock — Thu, 01 Mar 2018 18:08:53 GMT

Hi folks,

We have a Wildfire public cloud subscription, dynamic updates, and security profile configured.

I've been asked, "How do we know it's doing anything?".

When I look at Wildfire submissions, the last submissions are from January and end of last year.

I am looking at this article and our settings, I don't think our's looks correct. Our File Blocking rule is empty and the Wildfile analysis does not look linked to the File blocking profile either.

So while we are enabled for Wildfire, I don't think it is doing anything because not configured right.

We should at least have a File Blocking rule in place for it to do anything right?

Re: Wildfire Activity?

OtakarKlier — Thu, 01 Mar 2018 19:49:32 GMT

Hello,

Check your wildfire config and see if its se to report greyware and benign files. When I fileted my logs to remove the benign files, there was not much shown.

Device tab -> Setup -> Wildfire

That could be why you dont see any activity in the Monitor Logs.

Hope that helps.

Re: Wildfire Activity?

OMatlock — Thu, 01 Mar 2018 19:59:32 GMT

Thank you!

Yep, your right. I do not have those options checked, and I suppose that there must not be a lot of unknown file types downloaded in our environment.

Seems like File Blocking and Wildfire work separately?

Don't need File Blocking configured for Wildfire to be in use, correct?

Re: Wildfire Activity?

OtakarKlier — Thu, 01 Mar 2018 20:07:02 GMT

Hello,

They work together kinda. You need the file blocking rule so WF can be applied to a polic. The Wildfire analysis is needed to actually grab the files and send them to the cloud.

Hope that makes sense.

Regards,

Re: Wildfire Activity?

OMatlock — Thu, 01 Mar 2018 20:27:01 GMT

Thank you!

Ok, getting close, but still a little confused. This text from my 7.0 training seems to indicate that they may operate and detect separately? Meaning I could have no File Blocking rule (like my company has here) and just a Wildfire rule for PE and those files would be shipped off to Wildfire Cloud?

However, this Wildfire test PE URL: http://wildfire.paloaltonetworks.com/publicapi/test/pe does not show up as uploaded to Wildfire when I run command: debug wildfire upload-log show.

I may need to call support to get all this cleared up.