Wildfire Action doubt

[SOC_CSG]

Hello,

We do not have license wildfire in some of our devices.

Do you know if wildfire action (Antivirus Profile) would function without this license?

Regards,

dicu

[hshah]

Hi COS,

Without Wildfire license you an only send  files to wild-fire cloud. In case of malicious file anti-virus database will not be updated in 1 hour.

But, antivirus database will be updated next day with regular dynamic update.

Regards,

Hardik Shah

[pulukas]

If you do not have a wildfire subscription, then the Wildfire column will never apply to your traffic.  These actions apply only when the traffic triggers a wildfire signature and you indicate which action this should take.  When the traffic hits a standard AV signature it takes the action listed in the first column.  If you don't have wildfire those signatures are not present and won't be used so you will never have a trigger event.  You may want different actions for wildfire triggers because they are by nature less tested and more prone to false positives that can block legitimate traffic.

From the manual:

You can define different actions for standard antivirus signatures (Action column) and signatures generated by the WildFire system (WildFire Action column). Some environments may have requirements for a longer soak time for antivirus signatures, so this option enables the ability to set different actions for the two antivirus signature types provided by Palo Alto Networks. For example, the standard antivirus signatures go through a longer soak period before being released (24 hours), versus WildFire signatures, which can be generated and released within 15 minutes after a threat is detected. Because of this, you may want to choose the alert action on WildFire signatures instead of blocking.