Wildfire actions

[FWPalolearner]

Hi ,

i have 3 question for wildfire 

1)If we define wildfire profile , and call that profile in a security rule , only that particular rule will be effective for wildfire analysis and not all the rules in the policy ?

2)Also , as a starting point , we want to limit sending all the file types to Wildfire , is there any initial level Wildfire categories to start with ?

3) Also , i dont see any action for wildfire profile , does the action depend upon AV , Antispyware profiles where we also have widlfire action ?

[kiwi · Accepted solution]

Hi @FWPalolearner ,

1) that is correct.

2) Not really, limit at your discretion I would say. 

The default WildFire Analysis profile specifies that all supported file types across all applications are forwarded for WildFire analysis in either direction.  If you create a custom WildFire Analysis profile, it is a best practice to still set the profile to forward any file type. This enables the firewall to automatically begin forwarding file types as they become supported for WildFire analysis.

3) Correct, there is no action in the profile.  It's purely for the analysis, not for the prevention at this stage.

Cheers !

-Kiwi

[FWPalolearner]

@kiwi Thanks a lot . really appreciate