topic Re: Wildfire actions in General Topics

Wildfire actions

FWPalolearner — Wed, 13 Jan 2021 10:51:33 GMT

Hi ,

i have 3 question for wildfire

1)If we define wildfire profile , and call that profile in a security rule , only that particular rule will be effective for wildfire analysis and not all the rules in the policy ?

2)Also , as a starting point , we want to limit sending all the file types to Wildfire , is there any initial level Wildfire categories to start with ?

3) Also , i dont see any action for wildfire profile , does the action depend upon AV , Antispyware profiles where we also have widlfire action ?

Re: Wildfire actions

kiwi — Wed, 13 Jan 2021 12:50:36 GMT

Hi @FWPalolearner ,

1) that is correct.

2) Not really, limit at your discretion I would say.

The default WildFire Analysis profile specifies that all supported file types across all applications are forwarded for WildFire analysis in either direction. If you create a custom WildFire Analysis profile, it is a best practice to still set the profile to forward any file type. This enables the firewall to automatically begin forwarding file types as they become supported for WildFire analysis.

3) Correct, there is no action in the profile. It's purely for the analysis, not for the prevention at this stage.

Cheers !

-Kiwi

Re: Wildfire actions

FWPalolearner — Wed, 13 Jan 2021 13:52:30 GMT

@kiwi Thanks a lot . really appreciate