Wildfire - Connection hold

[TheRealDiz]

Hi all,

Just a question:

I didn't understand Wildfire mechanism related to a single session.

Is there a connection hold when waiting for a response (benign, malicious) from PA cloud by default? Is that configurable?

If the answer is Yes, but where?

Best Regards

Luca A. Di Leo

[reaper]

Hi @TheRealDiz

no the session is not held

if a file is received one of 3 actions can happen

file known malicious: blocked based on signature that was created prior

file known benign: file is passed through, benign logging is added (if benign logging is enabled)

file unknown: session is allowed to pass, file is grabbed and uploaded to WildFire for analysis, file is analysed and afterward the verdict is attached to the logging. if malicious: signature is created and rolled out to all WildFire customers

[TheRealDiz]

Hi @reaper,

You are always on point, thanks a lot for your quick response.

So in conclusion, is this mechanism not configurable?

Thanks again

Luca

[reaper · Accepted solution]

Hi @TheRealDiz

that's right, thre is no holding mechanism pending a verdict

i looked it up and there is already a feature request : FR2833

please reach out to your local sales team and have them add your vote 🙂

[TheRealDiz]

Many Many thanks,

Infact I didn't find anything related to this argument inside Wildfire's documentation.

Have nice day! 🙂