Trouble differentiating between malware already seen by WildFire and malware 'first seen' by WildFire

[r_gine]

I'm having trouble determining which malware has already been seen by WildFire (therefore it was not re-sent for analysis and blocked by the FW) vs. a file that our organization sent to WF and was determined to be malicious after analysis (not seen before by WF) . This would significantly help our organization respond to malicious files that may have made it to internal systems (mail servers, desktop, etc). Right now, I go into the analysis report and look at the first seen date... I know there's a better way.

Thanks!

[bmorris1]

Hello r_gine,

If a file has already been seen by wildfire then it will show as wildfire skip in the log.

Ben

[santonic]

In Data Filtering log:

- action 'wildfire-upload-success' means file was first seen by your device,

- action 'wildfire-upload-skip' means file was already known to WF

Yes, unfortunately you need to look in 2 log files to see if it was malicious and if you were first to see it.

[mvidic]

In addition to what @santonic said, you should have a look at WildFire Submissions log. By default it will only display malicious files that were uploaded to the cloud, from which we can conclude that those files have not been previously seen by the WF cloud, were not blocked and made it through to your network.

You can also turn on option Device > Setup > Wildfire > Report benign files. With this option enabled Wildfire Submissions log wil also display Benign files which were uploaded to the cloud.