Malicious file not getting blocked

[Farzana]

Hello,

An email attachment has been classified by Wildfire as malicious. However, it was not blocked and just an alert was logged.

Below are two screenshots from the Wildfire submission and threat logs.

Any idea why has the Vulnerability Protection classified this threat as medium even though WildFire classified this file as malicious? How to make sure it is blocked?

Thanks in advance.

[kiwi]

Hi @Farzana,

I'm guessing you don't have your device configured to drop this.

The default WildFire action for the SMTP decoder is alert :

default action for smtp decoder is alert

Also, this article might be useful :

How-to-Enable-WildFire-to-Block-File-with-malicious-Verdict

Hope this helps !

-Kiwi.

[BPry · Accepted solution]

@Farzana,

Something to keep in mind as well is that most documents that I see from SMTP has to be sent to wildfire and the verdict has to come after it's been analyzed; so dropping it on the fly doesn't really work that well and might not be advisable depending on your companies tolerance to any false positive emails being unrecoverable.