Thanks Lucky. I understand what you are saying but I guess I am just seeing a bunch of inconsistencies. What I am observing is related to malicious smtp traffic. In my screenshots below you will see IP 87.236.215.57 in the wf submission log and a corresponding wf-virus signature in the threat log as there happens to be wf-virus sig in this case. Which has been what we have grown to expect since using wf. Also in the screenshots you will see IP 182.160.108.150 in the threat log tripping wf-virus signatures but no wf-submissions.  I am fine with no wf report if a wf-virus is tripped but just the inconsistency is what has me puzzled.   ... View more

thanks Brandon_Wertz.   I guess what is confusing for me is when we have wf submissions  and a wildfire-virus signature is available we typically see a 1:1 corrilation. But earlier today I noticed we had about 200 wildfire-virus signatures tripped in the threat logs but no wf submissions related to these.  ... View more

We experinced this too. I suspect you are sending multiple users out to the internet behind one address and if you look at the reply traffic you will see it getting dropped at the NAT ip. Our firewall team suggested the group looking to use Lifesize to get in contact with the vendor to assist with resolution.      ... View more

apparently there is a backend issue that is being worked on. not sure when it will be corrected. ... View more

Yup. In the wildfire portal all 3 of us have them set to only send notifications for malware. This had always functioned properly until about a month ago.    also of note that i forgot to mention is we do not even see these notifications arriving to our spam gateway. For example admin 1 gets 45 malware WF notifications and see all 45 email notifications in spam gateway sent to admin 1, meanwhile admn 2 and admin 3 configured the same as admin 1 receive 3 malware WF notifications and no wildfire email notifications sent to admin 2 and 3 are in the spam gateway either. ... View more