Advanced WildFire Inline ML - Processing Flow

[John_J]

Does anyone know where in this processing flow does Advanced WildFire Inline ML take place.  It would be before the file is sent to WildFire Cloud but would the file be inspected before or after checking the file size?

Also, are email links inspected by Advanced WildFire Inline ML?  From my understanding email links use dynamic analysis in WildFire Cloud which isn't the same as Inline ML.

Thanks,

John

[ozheng]

Hello John_J,

Assuming you are referring to the Wildfire Inline ML (configured in the AV profile), I am not aware of some size limit : the file is checked real time by the firewall against its ML model.
Then a file blocked would still be sent to Wildfire to check (update ML model if needed). At that stage, I guess you can have the size limit.

Regarding the email, I guess you are more referring to the inline URL categorisation.
I am not sure if the email is inspected, but the actual query (once someone click on the link) to the URL would be blocked by the firewall thanks to the URL filtering.
Also, we have prepared a PANCast episode to discuss about phishing and the countermeasure on PAN-OS.

Update : https://live.paloaltonetworks.com/t5/pancast/pancast-episode-25-phishing-emails-and-relevant-threat/...

Olivier