Wildfire new threat signature update

[MP18]

As per Admin guide

The Palo Alto Networks WildFire system also provides signatures for persistent threats that are more evasive and have not yet been discovered by other antivirus solutions. As threats are discovered by WildFire, signatures are quickly created and then integrated into the standard Antivirus signatures that can be downloaded by Threat Prevention subscribers on a daily basis (sub-hourly for WildFire subscribers

Does it mean that WF if does not know any Antivirus signature it quickly creates it and when we have 5 mins update with

WF cloud  that new signature comes and becomes part of antivirus profile only.

Need to know when new signature comes from WF it is only for the Antivirus profile?

[LukeBullimore · Accepted solution]

Hi Mike,

If WildFire analyses a file that it has never seen before - if the verdict is deemed as malicious it will create a signature that can be made available to people with a WildFire license within 5 minutes. Otherwise if you don't have a WildFire license, it will be made available within 24/48 hours via a threat content update - provided you have a threat prevention license.

WildFire signatures are enforced via the "WildFire Action" in an antivirus security profile, yes - but as well as the DNS signatures enforced via an antispyware security profile.

https://www.paloaltonetworks.com/documentation/80/wildfire/wf_admin/wildfire-overview/wildfire-conce...

https://www.paloaltonetworks.com/documentation/81/pan-os/pan-os/threat-prevention/threat-signatures

[Raido_Rattameister · Accepted solution]

Firewall will create hash of file and send it to WF to check if this file has been checked before.

If it has then based on verdict file is permitted through or blocked.

If it has not been checked then file is passed through and copy is sent to WF to be analyzed.

Verdict will come back in 5 mins or less.

Those who don't have WF subscription can upload only PE files to WF (exe, dll etc) and they get rest of WF signatures with next Antivirus and Antispyware update.

[Remo]

@Raido_Rattameister

Sorry for being a smart aleck 😛

---

@Raido_Rattameister wrote:

Firewall will create hash of file and send it to WF to check if this file has been checked before.

If it has then based on verdict file is permitted through or blocked.

---

The firewall does not allow/block based on a WF verdict, only Traps does. The firewall only blocks based on WF signatures of malware-verdict-files which it receives all few minutes. The hash check is only done to check if the file is unknown and needs to be uploaded to WF.

[Raido_Rattameister]

Traps has capability to hold back execution of unknown file until verdict comes back from WF.

Firewall will pass unknown files through but those that have been already checked by WF and verdict was malicious are blocked.

This check is done based on file hash.

Check Action column on the screenshot.

[Remo]

In the wildfire log the action is only based on the fact if there is already a WF signature. So for every WF log entry with action block you also have a threat log entry either as virus or wildfire-virus. Thats also the reason why (also in your screenshot) you have malicious files with action allow. These with action allow are the ones where so far isn't a WF signature available.

Another reason why a signature is required is because paloalto firewalls are still stream based, they block the file already when the signature matches a part of the file, at that point the file doesn't have to be fully transfered.

[AK74]

HI Luke!

Which functionality is available to firewall users with an active Threat Prevention subscription, but no
WildFire license? Access to the WildFire API or PE file upload to WildFire?

Thanks