As per my understanding, you are correct. If the wildfire is not having a signature of that packet, it will trigger "forward" action to the cloud. And then the signature would be modified in threat database/PAN-DB. For your reference: How is a New Registered Domain Classified by PAN-DB? For malware domains, PAN-DB will categorize a URL or IP as malware as long as WildFire has associated it with malicious activity. Regarding the CryptoLocker lists published by the FBI and InfraGard, Palo Alto Networks does subscribe to these lists and will create threat signatures around them, as well as feed the domains and IPs listed into PAN-DB. For those malware families that utilize DGAs, Palo Alto Networks will phase in DNS signatures as those domains go live (typically a few days before), and then disable them as they are taken down. Starting with the most recent InfraGard list, (CryptoLocker, GameOver ZeuS), Palo Alto Networks started adding all domains at once to PAN-DB, and keeps them categorized as malware until otherwise notified. Hope this helps. Thanks
... View more
.png "Satish"){kind=avatar}
