How to Enable WildFire to block jar file with 'malicious' Verdict

[Steve-Phillips]

Hello Everyone,

New to Palo Alto firewalls and new to this forum.

Can I please ask how I go about changing the Wildfire action on a jar file to block?  The action for this file has been to allow the file, despite the file being flagged as "malicious, as can be seen below:

I wish to change the action to "block", as is the case with the "pe" files I can see in the Wildfire logs, as can be seen here:

Many thanks in advance.

Regards,

Steve

[BPry]

@Steve-Phillips,

Within the Antivirus Security Profile that is assigned to the rule allowing the SMTP traffic to pass, you'll have to modify the 'WildFire Action' to reset-both instead of the default action of 'alert'. This article HERE should point you in the proper direction

[Steve-Phillips]

Dear BPry, many thanks for your reply.

I have checked the Anti-Virus profile that is assigned to the applicable rule (Internet to Email Gateway) and the WildFire action is set to "reset-both" for all the listed decoders, including smtp, as can be seen here:

It would therefore seem that some other setting is at play here that is not immediately obvious.

I have examined the WildFire Analysis security profile, but this is set to analyze any file type and any application, so there does not appear to be a applicable setting here:

I'll continue to investigate..

Regards,

Steve

[BPry]

@Steve-Phillips,

So one thing to potentially think about is if wildfire actually 'knew' about the file yet. A file that hasn't been inspected by WildFire which doesn't have identifyable markers for the Antivirus engine may log an as an 'alert' action until a wildfire signature has been generated for it. That may explain why you are seeing 'alert' actions rather than the desired 'reset-both' with this traffic. 

[Steve-Phillips]

Dear BPry,

Many thanks for your reply and theory for why the email was allowed despite being malicious.

I have captured the timestamps of the Wildfire evets here, in case that helps accurately diagnose the issue:

WildFire Analysis Summary

File Information

File Type JAVA JARFile SignerSHA-256 149862f4894c9dba2b21b507fa7bde835e6a6a44e35040331c5ab1de3ec4027dSHA1 b8aed21b09bda3f02c54c53267ba696a1286e092MD5 0ecacad6f88e1ddb859e881c1662b4a9File Size 556535 bytesFirst Seen Timestamp 2018-01-26 06:28:06 UTCVerdict malware

Does this information give more visibility to the issue?

Many thanks,

Steve