WildFire Analysis Exclusions? smbv3

Rags — Fri, 05 Mar 2021 19:33:55 GMT

Seeing a lot of false positives with WildFire for application ms-ds-smbv3, specifically for PE+MSDOCX files. Is there anyway to just exclude ONLY this application from our Wildfire? I'd really hate to have to create a 2nd WildFire Security Profile and another Policy Rule just to exclude 1 application type. If we do have to create a 2nd WildFire Analysis Security Profile, can we just exclude only this ms-ds-smbv3 application?

Thanks for any information.

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/objects/objects-security-profiles-wildfire-analysis.html

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTSCA0

Re: WildFire Analysis Exclusions? smbv3

OtakarKlier — Mon, 08 Mar 2021 22:27:10 GMT

Hello,

I would consider opening a case with support if you see this as a false positive. This could help out others having a similar issue.

Regards,

topic Re: WildFire Analysis Exclusions? smbv3 in General Topics

WildFire Analysis Exclusions? smbv3

Re: WildFire Analysis Exclusions? smbv3