No logs in wildfire log section on device- PAN OS 5.0.3

Reply
L4 Transporter

No logs in wildfire log section on device- PAN OS 5.0.3

Hi ,

Even we have the valid wildfire subscription, not able to see any logs in wildfire logs in device but in the data-filtering logs for some exe files it is showing wildfire-upload-success         ( means file has uploaded to wildfire cloud for analysis).

I executed the commands  >test wildfire registration         -  showing registered

                                      >show wildfire status               - showing 4 files forwarded

Dynamic updates for wildfire has scheduled for 15 minute.

But still after 3 hours also i am not able to see any (verdict) logs in wildfire logs section on device.

"Is only for verdict"malicius" will be sent to device? 

Regards,

Gururaj

L5 Sessionator

Re: No logs in wildfire log section on device- PAN OS 5.0.3

By default, only malware logs are delivered to the device.

To turn on receiving reports for benign files:

CLI

#set  deviceconfig setting wildfire report-benign-file yes

#commit

L5 Sessionator

Re: No logs in wildfire log section on device- PAN OS 5.0.3

Here is some more relevant information regarding Wild fire

https://live.paloaltonetworks.com/docs/DOC-5266

Symptom

When a wildfire-upload-skip message is seen in the data filtering logs, all the files do not appear on the WildFire portal.

Cause

In PAN-OS 5.0, when a file is received by the firewall, a hash is created and checked with the WildFire server. If the hash matches on the WildFire server, the action wildfire-upload-skip is taken. At this point, one of the following occurs based on the categorization of the file:

  • If the file had been previously determined to be malicious, then the report, previously generated when the verdict was made, appears on the WildFire server.
  • If the file was not malicious and was determined to be benign, then the report is not shown on the WildFire server.

Thanks

Highlighted
L4 Transporter

Re: No logs in wildfire log section on device- PAN OS 5.0.3

Thank you Nadir  :-)

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!