Question to Wildfire appliance

[MPI-AE]

Hey all,

I have some questions to the wildfire appliance:

https://www.paloaltonetworks.com/documentation/60/wildfire/wf_admin/wf-500-file-analysis/about-the-w...

We don't use the public wildfire because we are not allowed to send secret files into the cloud because of strict data security policies.

So I thought to use the on-premise appliance.

But the article says "By default, the WF-500 appliance does not send any files to the Palo Alto Networks WildFire cloud. However, malware must be sent to the WildFire public cloud in order to receive antivirus signatures for the malware discovered by the appliance."

For me, that sentence is contradictory.

Can someone explain me what's exactly going on in the background?

[acc6d0b3610eec313831f7900fdbd235]

Hi @MPI-AE

You may want to refer to the WildFire documentation based on PAN-OS 7.1 instead, as it is a little bit more clear.

https://www.paloaltonetworks.com/documentation/71/wildfire/wf_admin/set-up-and-manage-a-wf-500-appli...

You can continue to enable a WF-500 appliance to:

• Locally generate antivirus and DNS signatures for discovered malware, and to assign a URL category to malicious links. You can then enable connected firewalls to retrieve the latest signatures and URL categories every five minutes.
• Submit malware to the WildFire public cloud. The WildFire public cloud re-analyzes the sample and generates a signature to detect the malware—this signature can be made available within minutes to protect global users
• Submit locally-generated malware reports (without sending the raw sample content) to the WildFire public cloud, to contribute to malware statistics and threat intelligence.

The sending to to the public cloud, can be optionally disabled.

I hope this helps.

[MPI-AE]

Hi @acc6d0b3610eec313831f7900fdbd235

yeah that helps, thank you!

Do you know by chance how much this appliance costs approx. ?

And do you think wildfire analysis are useful? Would/Do you use wildfire?

[BPry]

I would really reach out to your SE for valid appliance costs as nobody knows what your discount is going to be and it sounds like you would fall under government pricing. List on a WF-500 2TB RAID storage was reported at one point in time as $125,000 for the appliance; I'm sure that this pricing however if accurate at the time was list and you could expect a decent discount percentage off of that. 

Wildfire is extremely useful, I would take a look at some of the actual wildfire documentation and ask for a demonstration if you haven't used it before. If you have a lab enviroment where you could actually enable it there is limited capability without paying for it so that you could actually see how it handles the traffic and analyze part of it. 

[acc6d0b3610eec313831f7900fdbd235]

Hi @MPI-AE

One of the drivers that makes companies (especially government organizations and financial institutions) to purchase an on-premise sandbox like the WF-500, is for privacy reasons. There are other drivers, but this the main one.

Most of these organizations do not want to send their MS-Office files, PDFs to the public cloud for emulation; hence, they prefer to spend the money on purchasing a dedicated appliance to sit on their premise so that they know that that data is staying onsite.

There is also the issue of data sovereignty, since each country has different privacy laws such as the privacy laws in the US are different from the ones in Canada. In fact in Canada (especially in the West) it is extremely strict, and companies have to ensure that data does not leave Canada borders. Although Palo Alto has one a very good job in expanding its WildFire cloud coverage and capability, by implementing a dedicated datacenters in the EU, JP, and SG and the Global one which is located in the US, other countries like Canada have more strict laws that do not allow their data to reach countries in those regions.

As for pricing @BPry is correct. The appliance price is in the $125K USD as per the 2017 price list and it does not include support. The price is differentiated for governement agencies. But I encourage you to contact your local SE for further details or your reseller for quotes.

Anyway, I hope this clarifies .