topic WildFire Logs versus Blocking. in General Topics

WildFire Logs versus Blocking.

amansour — Thu, 07 Mar 2013 19:10:04 GMT

For WildFire logs in 5.0.2 there is some confusion about the subscription. The question most ask is whether the lack of a wildfire subscription will still allow the logs in the WildFIre section to accurately alert if a file is potentially malware. And in a general sense what the WildFire subscription gives you.

Re: WildFire Logs versus Blocking.

Abs — Thu, 07 Mar 2013 19:47:29 GMT

WildFire logs will still have the files analyzed against up to date information from the cloud, the subcription is to get those updates every 15 minutes and not over 24 hours. File rules establish the action for each EXE/PE file downloaded.

Re: WildFire Logs versus Blocking.

HITSSEC — Thu, 07 Mar 2013 20:13:53 GMT

Wildfire will function the same as in the non subscription version except the summary report you get via email is now in the console. If you have panorama or a siem you can more easily look at historical wildfire information or port the wildfire logs off to a separate place for analysis etc. The Wildfire logs will only come down to the console if you have the subscription service. Also you will get hourly wildfire AV files with the latest signatures as opposed to the daily AV files (which you will still get if you have a threat subscription).

Hope this adds some clarity?

Re: WildFire Logs versus Blocking.

amansour — Thu, 07 Mar 2013 20:34:12 GMT

Thanks HITSEC.