What is applied first Wildfire profile or AV profile? Is the file AV scanned or sandboxed first?

[Wasfi.Bounni]

Hi;

My understanding is that the PAN OS performs a hash of the file, then checks with Wildfire to see if this file has been seen or not. If it has not been seen, then it performs an AV scan on it to determine if it matches a known signature. If the file does not match any known signature, then and only then it gets sent to Wild-Fire public or private cloud for sandboxing.

Please comment if you can.

Kindly

Wasfi

[reaper · Accepted solution]

On-firewall AV scanning is done in transit, so bytes go through the firewall and bytes get scanned

If at any point during the flow a malicious signature is detected the flow is interrupted and the file transfer stopped

Only if the on-device scan does not block a file this way, will we be able to get to the end of the file and collect a hash to check with wildfire if the file has already been uploaded or not.

if the file has not been seen yet, it is uploaded and put in a sandbox

[Remo · Accepted solution]

Since march 2018 even files that match an AV signature will be forwarded to wildfire: https://docs.paloaltonetworks.com/wildfire/u-v/wildfire-whats-new/latest-wildfire-cloud-features/wil...