So, I just did a test by FTPing a malicious .exe file that was compressed inside of a .ZIP. My Data Filtering log shows the action for the .PE file within the .ZIP as "forward" however, I did not receive anything from the Wildfire Cloud. Also, the Wildfire Portal has no entry for this file being uploaded.
Any insight as to why Wildfire did not receive the file that had the "forward" action?
We have seen the same issue... files that are apparently "forwarded" to WildFire never show up as malicious, even files that we know are malicious.
We have asked Palo Alto for a test .exe that we can send across the network and will always flag as malicious... another malware appliance we have does this exact thing (similar to the EICAR antivirus file you can test AV solutions with)
What I do to get malicious files to test with Wildfire, is go to malc0de.com, go to the Tools menu and then click on "Search Malc0de Database". Then I type in .exe in the search window. This will pull up a list of files that are either malicious or at benign but, will actually trigger Wildfire actions on the PANW. I download that files to my Macbook so, they will not infect my machine. So far, so good for exercising Wildfire actions and the portal.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!