Wildfire Signature creation

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Wildfire Signature creation

L4 Transporter

Can someone share some facts about the process of the WF signature creation. It was promised by PAN to have a signature ready after 15Mins. a sample has been identified as malicious (Verdict Malware). My observation is that it usually takes much longer than that. We do have a WF subscription.

Example in the screenshot below.

Capture.JPG

9 REPLIES 9

L5 Sessionator

Hi @gafrol,

Sometimes when you see file marked as malicious in wildfire and even after 15-30 minutes if you are able to download the file, one of the reason it might be due to signature generated off the file in question. This might be deemed false positive and would not be added to distributed signature list. Where as wildifire still categorized as malicious. You can dispute the verdict via wildfire or open a support case for further analysis. Hope this helps. Thank you.

The above sample was neither a false positive nor an incorrect verdict. It is clearly malicious and as such identified by Wildfire. It took more than 24 hours to have a WF signature ready for deployment. This is not an exception, I observe many of these "delayed" WF signatures, which is a rather strong deviation from what is promised by Marketing.

Hi @gafrol,

For such cases I would suggest opening support case, so we can look at individual instance to see why it took more time than usual for signature distribution. If there is an issue, it will help us to fix the issue in future as well. If it was expected, then we can inform you with the reason. Hope this helps. Thank you.

I already opened a case two days ago, no answer so far. Seems to be difficult to answer this one ....

BTW where are all the release notes for the WF signatures ? On the PAN FW's I only find the two most recent WF RN's....

Capture.JPG

This does not add any transparency for customers at all. Also what is the timezone given in the "Date Released" field ?

Capture.JPG

Hi,

same case. WF not fire a file with malware verdict. This file has been block 24 hours later by PA AV.

Have you received a response of support ?

Did you find old wildfire release notes?

Thanks

After three weeks they found out they had some maintenance tasks running from Nov.8 - Nov. 10.which delayed the signature creation for 8 hours....

L4 Transporter

Hello,

I have just checked the malware specimen you mention in the original post and this is the information we have in our internal database:

sidmidCreate/Update TimehashfamilytypeplatformPE signerSourceVTWFMSmalware
352485241818320462014-11-11 07:17:39

2014-11-15 13:12:47

ca7cde7b264002875917f8d9dffce121

52fd417b6f1a4a369a03bf5c449f380b3415d37fcc8e99d03c72bf0d07831986

emotetTrojanWin32Wildfire40

link

13 1

Wildfire signature was created on 2014-11-11 at 07:17 PST, this is 8 minutes after the specimen was first seen, 2014-11-11 16:09. The last update of the signature was on 2014-11-15.

Apart from the glitch experienced by Wildfire Cloud in November as mentioned above, you may experience situations in which a signature is not created automatically, specially with PE files.

The main reason is that the automatic signature for a malicious PE file matches the signature for white-listed benign PE files and therefore the signature is not pushed automatically to avoid blocking legit PE files.

In 6.1, we have introduced some changes in the automatic signature generation process that will reduce significantly the number of occasions in which this happens.

For a few more Wildfire signatures release notes you can check https://support.paloaltonetworks.com/Updates/DynamicUpdates/

If you have specific questions about a Wildfire signature release or a specific signature, please open a support case and we will help you finding the information you need.

I hope this helps.

Regards,

Guillermo.

In my initial Post it says that the WF signature was released on 2014-11-13 05:04:03 (Timezone unknown...) Can you clarify ?

Apart from the glitch experienced by Wildfire Cloud in November as mentioned above, you may experience situations in which a signature is not created automatically, specially with PE files.

If that's the case, I wish there was some sort of notification in the WF report. Since today is Christmas Day in my country there are some more wishes regarding WF report

- Add Date and Time  of initial Release of the coverage

- Add Last Update Time and Date of the same

- Add Timezone Information to the Time stamps and display it according the timezone information in the User settings of the WF Portal

This would add some transparency and avoids confusion.

Happy Holidays

Roland

Hello Roland,

Yes, the date you saw in Wildfire Report corresponds to a signature update, the original signature was created on 2014-11-11.

I think your proposed enhancements are very reasonable. I encourage you to contact your local Palo Alto Networks SE as they are the ones driving Feature/Enhancement Requests.

Happy Holidays to you too.

Regards,

Guillermo.

  • 5280 Views
  • 9 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!