topic Re: wildfire submission issue in General Topics

wildfire submission issue

Joshan_Lakhani — Fri, 28 Aug 2020 08:43:43 GMT

There are certain files which were sent to wildfire for multiple times and every time we have received verdict as malicious.
The same file (i have verified the file hash available in wildfire cloud) is submitting multiple times even after the verdict is malicious from old wildfire submission but it's not block. As iam running 9.0.5 PAN-OS version please suggest

2020-08-25 11:04:58 +0300: proforma invoice.rar archive skipped - remote malware dup PUB 30644 731368 527539 0x101c allow

2020-08-25 11:05:00 +0300: proforma invoice.rar archive skipped - cached malware dup PUB 157936 731369 527539 0x124c allow

2020-08-25 13:47:02 +0300: proforma invoice.rar archive skipped - remote malware dup PUB 28172 732436 527539 0x101c allow

2020-08-25 14:23:29 +0300: proforma invoice.rar archive skipped - remote malware dup PUB 146272 732682 527539 0x101c allow

But when i check customer is receiving the Malware file multiple times

Re: wildfire submission issue

OtakarKlier — Fri, 28 Aug 2020 20:58:05 GMT

Hello,

Are you policies set to block this content of malicious Wildfire files?

https://docs.paloaltonetworks.com/wildfire/9-1/wildfire-admin/wildfire-deployment-best-practices/wildfire-best-practices.html

Regards,

Re: wildfire submission issue

Joshan_Lakhani — Fri, 28 Aug 2020 21:08:01 GMT

@OtakarKlier thanks for your reply

As we same file with same hashes are blocked.But after some hours same file with same hashes are allowed by paloalto. Please suggest

PAN-OS version 9.0.5

Re: wildfire submission issue

OtakarKlier — Fri, 28 Aug 2020 21:22:33 GMT

Hello,

I would open a tac case and see what they have to say. They can look at the PAN and file more closely.

Regards,

Re: wildfire submission issue

Joshan_Lakhani — Fri, 28 Aug 2020 21:33:06 GMT

@OtakarKlier

Paloalto verdict are malware and allow the traffic but from paloalto there is fortimail which is behind the paloalto and they reject these file.

Re: wildfire submission issue

bit_byte — Sat, 29 Aug 2020 20:08:24 GMT

@Joshan_Lakhani

why firewall submitted the same sample to wildfire multiple times.you would get idea in ms.log

Please share ms.log

Re: wildfire submission issue

Joshan_Lakhani — Sat, 29 Aug 2020 20:21:17 GMT

@bit_byte thanks for you reply

As iam not seen any thing in ms.log

020-08-25 08:56:05.679 +0300 No new WildFire updates available for download
2020-08-25 08:57:01.148 +0300 pan_dynupdsch_local_refresh(pan_cfg_dynupdsch.c:2054): scheduled-update: "_SystemWildfireUpdate_" refreshing of WildFire
'cfg.platform.express-mode': NO_MATCHES
NO_MATCHES
NO_MATCHES
2020-08-25 08:57:05.328 +0300 No new WildFire updates available for download
2020-08-25 08:57:41.884 +0300
##### Non-BATCH report found (acc-summary)
2020-08-25 08:57:41.885 +0300 report generation started for 'acc-summary'
2020-08-25 08:57:41.885 +0300 ** generating report for time from 1598331461 to 1598335060
2020-08-25 08:57:41.915 +0300
##### Non-BATCH report found (acc-summary)
2020-08-25 08:57:41.979 +0300 client dagger reported op command was SUCCESSFUL
2020-08-25 08:57:42.237 +0300 report generation started for 'acc-summary'
2020-08-25 08:57:42.237 +0300 ** generating report for time from 1598331461 to 1598335060
2020-08-25 08:57:42.273 +0300 client dagger reported op command was SUCCESSFUL
2020-08-25 08:57:42.685 +0300
##### Non-BATCH report found (custom-dynamic-report)
2020-08-25 08:57:42.687 +0300 report generation started for 'custom-dynamic-report'
2020-08-25 08:57:42.689 +0300 ** generating report for time from 1598331462 to 1598335061
2020-08-25 08:57:42.853 +0300 client dagger reported op command was SUCCESSFUL