Hi Lewis,
Malware IDs are different, so those are two different attacks in my opinion. For first one (ID 3130795) you generated signatures yourself (doc1.doc files that were arriving between 13.32 and 15.24), second (ID 3079875) and third round (ID 3092456) came later.
I don't see discrepancy in your threat logs as I can see good timeline for 3130795 that corresponds with Wildfire uploads of doc1.doc; subsequent attacks in your threat logs were prevented by signature 3092456 that was generated by upload from some firewall other than this one; therefore no logs and/or reports are available in WF submissions. That is why you are using WF subscription, even if someone else uploads malware you will get signature back as soon as they do.
Only thing that is not looking as usual is that you kept uploading same file between 13.43 and 15.24; USUALLY you would get WF signatures within one hour if your download-and-install interval is set to 15 minutes. Considering that you had larger window of previous malware (again uploading between 00.49 and 2.55) I would just make sure Wildfire signatures are on 15 minutes schedule, it looks more if you have it set in one-hour intervals.
Best regards,
Luciano
... View more
