Info Wildefire analysis and wildefire in antivirus profile

[Gianpiero]

Hai all

after the upgrade to new version of pan os(7.0.13) i found some difference in security profile. Can you help me to understand the difference between:

- Security Profile > Antivirus > wildefire action

- Security Profile > Wildefire Analysis

is Antivirus profile to block malicious file knew in the dat file and wildefire for zero day files?Why there is a second wildefire profile in the Antivirus profile?If i make a rule which profile must i apply to the rule?

Thanks all

Gianpiero

[reaper]

hi there

there's 2 parts to Wildfire: one it the uploading and analyzing of files, which return you a verdict for that file

the second part is creating a signature to block these files for everyone that has downloaded the dynamic update package

so - Security Profile > Antivirus > wildefire action : is which actions to take on signatures matching the wildfire content update

it requires you to have the separate wildfire license

and - Security Profile > Wildefire Analysis : is what you want to do with files going through the firewall - upload them to wildfire or not

hope this makes sense ?

[sullivanpj2]

If I remember correctly, the AV profile allows you to set actions (reset-client, reset-server, etc) based on the decoder (http, ftp, pop3, etc). The Wildfire Analysis profile allows you to set which files you want to upload to the wildfire engine (public or private).

https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/policy/antivirus-profiles#19476

https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/policy/wildfire-analysis-profiles.ht...

Hope that helps!

- Peter