Wildfire new threat signature update

[MP18]

As per Admin guide

The Palo Alto Networks WildFire system also provides signatures for persistent threats that are more evasive and have not yet been discovered by other antivirus solutions. As threats are discovered by WildFire, signatures are quickly created and then integrated into the standard Antivirus signatures that can be downloaded by Threat Prevention subscribers on a daily basis (sub-hourly for WildFire subscribers

Does it mean that WF if does not know any Antivirus signature it quickly creates it and when we have 5 mins update with

WF cloud  that new signature comes and becomes part of antivirus profile only.

Need to know when new signature comes from WF it is only for the Antivirus profile?

[vsys_remo]

In the wildfire log the action is only based on the fact if there is already a WF signature. So for every WF log entry with action block you also have a threat log entry either as virus or wildfire-virus. Thats also the reason why (also in your screenshot) you have malicious files with action allow. These with action allow are the ones where so far isn't a WF signature available.

Another reason why a signature is required is because paloalto firewalls are still stream based, they block the file already when the signature matches a part of the file, at that point the file doesn't have to be fully transfered.

[AK74]

HI Luke!

Which functionality is available to firewall users with an active Threat Prevention subscription, but no
WildFire license? Access to the WildFire API or PE file upload to WildFire?

Thanks