Advanced WildFire Inline ML - Processing Flow

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Advanced WildFire Inline ML - Processing Flow

L1 Bithead

Does anyone know where in this processing flow does Advanced WildFire Inline ML take place.  It would be before the file is sent to WildFire Cloud but would the file be inspected before or after checking the file size?

 

Also, are email links inspected by Advanced WildFire Inline ML?  From my understanding email links use dynamic analysis in WildFire Cloud which isn't the same as Inline ML.

 

WildFire Flow Diagram.png

 

Thanks,

John

1 REPLY 1

L4 Transporter

Hello John_J,

 

Assuming you are referring to the Wildfire Inline ML (configured in the AV profile), I am not aware of some size limit : the file is checked real time by the firewall against its ML model.
Then a file blocked would still be sent to Wildfire to check (update ML model if needed). At that stage, I guess you can have the size limit.

Regarding the email, I guess you are more referring to the inline URL categorisation.
I am not sure if the email is inspected, but the actual query (once someone click on the link) to the URL would be blocked by the firewall thanks to the URL filtering.
Also, we have prepared a PANCast episode to discuss about phishing and the countermeasure on PAN-OS.

 

Update : https://live.paloaltonetworks.com/t5/pancast/pancast-episode-25-phishing-emails-and-relevant-threat/...

 

Olivier

PCSNE - CISSP

Best Effort contributor

Check out our PANCast Channel

Disclaimer : All messages are my personal ones and do not represent my company's view in any way.

  • 853 Views
  • 1 replies
  • 0 Likes
  • 38 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!