Hello Mike, PAN will check the hash of that file, hence not matter, what file name it is ( file.exe or file1.exe). Few more info: To verify, if any files have been forwarded to the server, enter the following command: > show wildfire status Connection info: Wildfire cloud: default cloud Status: Idle Best server: va-s1.wildfire.paloaltonetworks.com Device registered: yes Service route IP address: 192.168.1.1 Signature verification: enable Server selection: enable Through a proxy: no Forwarding info: file size limit (MB): 2 file idle time out (second): 90 total file forwarded: 0 >>>>>>>>> forwarding rate (per minute): 0 concurrent files: 0 The total file forwarded counter will provide the number of files being forwarded to the server. Data filtering logs can be used to check the status of the file. Here are the three actions available: Action-1: Forward but no wildfire-upload-success or wildfire-upload-skip, means the file is either signed by a trusted file signer, or it is a benign sample that the cloud has already seen. Below is an explanation of the different status possibilities. Forward - Data plane detected a PE (Potentially Executable) file on a WildFire-enabled policy. The PE file is buffered in the management plane. If only forward is displayed for a specific file, it is either signed by a trusted file signer, or it is a benign sample that the cloud has already seen. In either case, no further action is performed on the file, and no further information is sent to the cloud (not even session information is sent for previously seen benign files). There will not be an entry in the WildFire Web portal for these files. Thanks
... View more
.png "Satish"){kind=avatar}
