wildfire logs showing allow action for malicious url

Deepak_K — Tue, 21 Jul 2020 06:03:56 GMT

Two wildifire logs (16 July and 20 July ) are showing for same url with malicious verdict and action is allow. We have checked wildfire report of both logs , all information is same (same hash value , first timestamp seen is 7 July etc. ).

If same url is identified in 7 July then why its showing in wildifre submission logs. Also why action is allow showing in second and third occurrence ?

Re: wildfire logs showing allow action for malicious url

Remo — Sat, 01 Aug 2020 19:03:42 GMT

Hi @Deepak_K

In what traffic did you see these logs? If it was in smtp traffic then this is expected behaviour. In smtp paloalto sees and forwards email-links to wildfire, but cannot take actions based on urls.

topic wildfire logs showing allow action for malicious url in General Topics

wildfire logs showing allow action for malicious url

Re: wildfire logs showing allow action for malicious url