block http download based on the download file hash value

[nextgenhappines]

Dear all,

I have asked to look for a solution,  we want to receive alert based on specific file download via http, we have the file MD5 or SHA1 hash value.   Can I do this with a PAN?  The filename could change,  I don't know the file size but I have the file hash value..

Thanks for your helps in advanced,

E 

[pankaku]

If you want to block/alert a file with hash value it is not possible.

[reaper]

Hi E

The Palo Alto Networks firewall performs stream-based inspection of file transfers, so no proxy functionality is applied, hence no sha or md hash is collected. We can, however, identify files by all kinds of other means. Could there perhaps be any other identifiable markers, watermarks, headers, propietary strings of data in the file? these could be easily added to a custom app or threat profile, or as a data filtering profile.

regards

Tom

[rmonvon]

Hi...One option is to use WildFire subscription to upload all interesting file to our WildFire cloud for analysis.  From its portal you can see all the files and find the file to match your MD5 hash.