I have a question regarding this new functionnality for PANOS 6.1.0 version.
One of my customer has tested, but he doesn't get an email when a suspicious link in an email is send/received by users.
So I tested on our lab, and I have the same behavior. I use the informations from WildFire Email Alerts: Subscribe or Add Additional Recipients
It seems to detect threat links as informational/low severity for smtp:
Even if the link I used for my test in the email, is known as malware by Wildfire:
And it's blocked when I use this link on my browser:
So, did anyone has successfully applied this functionality and received an email alert?
And which link do you use to test it?
my configuration is fine, other suspect files are send to WF, and on this specific function in the screnshot, you can see that "wildfire-upload-success" is the action.
For other questions:
> show wildfire status
Wildfire cloud: public cloud
Best server: eu-s1.wildfire.paloaltonetworks.com
Device registered: yes
Valid wildfire license: yes
Service route IP address: 22.214.171.124
Signature verification: enable
Server selection: enable
Through a proxy: no
File size limit info:
pe 2 MB
apk 10 MB
pdf 400 KB
ms-office 500 KB
jar 1 MB
flash 5 MB
file idle time out (second): 90
total file forwarded: 647
file forwarded in last minute: 0
concurrent files: 0
> show wildfire statistics
Packet based counters:
Total msg rcvd: 269318
Total bytes rcvd: 224453980
Total msg read: 241801
Total bytes read: 197836829
Total msg lost by read: 27517
Total DROP_NO_MATCH_FILE 27517
Total files received from DP: 2155
Counters for file cancellation:
Counters for file forwarding:
file type: apk
file type: pdf
file type: email-link
file type: ms-office
file type: pe
file type: flash
file type: jar
file type: unknown
file type: pdns
DP receiver reset cnt: 1
File cache reset cnt: 1
Service connection reset cnt: 1
Log cache reset cnt: 1
Report cache reset cnt: 1
File forwarding queues:
priority: 1, size: 0
priority: 2, size: 0
priority: 3, size: 0
@Hardik: The file blocking profile is set to "forward"
@Hari:that's an interesting point, so this is relevant only to unknown applications not seen by WildFire?
Because what I have understood, and also my customer, is for every suspect application, we will get an email alert from device with this.
My apologies, I stand corrected.
For any http or https links in an email body firewall does not check virus database because firewall cannot hash links and so it has to send any links to wildfire and should get a report.
Once the firewall receives a report then you will receive wildfire report via email.
Could you please run the below command and check for the "Wildfire logs written"
> debug log-receiver statistics
Now try to download an exe file . You can use the link " http://wildfire.paloaltonetworks.com/publicapi/test/pe"
Check if the counter increases. This will let us know if the counter will indicate if the wildfire logs are written.
Restart var-data receiver, management server and device server one at a time to see if it fixes the issue
> debug software restart vardata-receiver
>debug software restart management-server
> debug software restart device-server
If this does not resolve the issue please turn ON the debug for the the following daemon
> debug vardata-receiver on debug
> debug device-server on debug
>debug log-receiver on debug
Run the test again and turn off the above debugs. Then download a tech support file and contact TAC for further assistance.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!