Antivirus Profile - Wildfire Inline ML - best approach to enabling?

[TonyDeHart]

We currently have the ability to use WildFire Inline ML via the Antivirus Profile settings on our PA-5220's.  However, all models currently are set to ACTION = DISABLE. I do NOT know why other than either that is what it defaulted to on a previous upgrade or my predecessor had a reason to leave it off.

What is the best approach to activating this without potentially causing issues with false positives but NOT leaving us more vulnerable while we turn it up?

I assume setting the action to ALERT-ONLY (override more strict actions to alert) would be the option to choose but the I'm concerned by it overriding more strict options it is effectively going to turn OFF scanning/analysis that is already in effect.

I'd appreciate any insight from others with more experience.

Thank you.

[JayGolf · Accepted solution]

Hi @TonyDeHart ,

The Advanced Wildfire Inline ML compliments your Threat Prevention License with basic Wildfire capabilities. Using the Wildfire Inline ML will not turn off scanning/analysis in security profiles that are attached to existing security policies. 

Consider creating and placing your alert-only Wildfire Inline ML enhanced security policies below your existing security policies in select zones where you are able to test and monitor the new capability in your environment. 

[TonyDeHart]

Thanks for the suggestion. I'll see where they may be a place that is appropriate but I can't think off hand right now where there would be a place for it that traffic would ever reach since anything valid (outside of intrazone) would hit other rules above it.  Perhaps I can also place a rule above somewhere with a very limited scope to see how it fairs before a wider application.