No logs in wildfire log section on device- PAN OS 5.0.3

[Gururaj]

Hi ,

Even we have the valid wildfire subscription, not able to see any logs in wildfire logs in device but in the data-filtering logs for some exe files it is showing wildfire-upload-success         ( means file has uploaded to wildfire cloud for analysis).

I executed the commands  >test wildfire registration         -  showing registered

                                      >show wildfire status               - showing 4 files forwarded

Dynamic updates for wildfire has scheduled for 15 minute.

But still after 3 hours also i am not able to see any (verdict) logs in wildfire logs section on device.

"Is only for verdict"malicius" will be sent to device? 

Regards,

Gururaj

[UhMayYeah · Accepted solution]

By default, only malware logs are delivered to the device.

To turn on receiving reports for benign files:

CLI

#set  deviceconfig setting wildfire report-benign-file yes

#commit

[mbutt]

Here is some more relevant information regarding Wild fire

https://live.paloaltonetworks.com/docs/DOC-5266

Symptom

When a wildfire-upload-skip message is seen in the data filtering logs, all the files do not appear on the WildFire portal.

Cause

In PAN-OS 5.0, when a file is received by the firewall, a hash is created and checked with the WildFire server. If the hash matches on the WildFire server, the action wildfire-upload-skip is taken. At this point, one of the following occurs based on the categorization of the file:

• If the file had been previously determined to be malicious, then the report, previously generated when the verdict was made, appears on the WildFire server.
• If the file was not malicious and was determined to be benign, then the report is not shown on the WildFire server.

Thanks

[Gururaj]

Thank you Nadir  🙂