Hello my configuration is fine, other suspect files are send to WF, and on this specific function in the screnshot, you can see that "wildfire-upload-success" is the action. For other questions: > show wildfire status Connection info: Wildfire cloud: public cloud Status: Idle Best server: eu-s1.wildfire.paloaltonetworks.com Device registered: yes Valid wildfire license: yes Service route IP address: 62.23.197.100 Signature verification: enable Server selection: enable Through a proxy: no File size limit info: pe 2 MB apk 10 MB pdf 400 KB ms-office 500 KB jar 1 MB flash 5 MB Forwarding info: file idle time out (second): 90 total file forwarded: 647 file forwarded in last minute: 0 concurrent files: 0 > show wildfire statistics Packet based counters: Total msg rcvd: 269318 Total bytes rcvd: 224453980 Total msg read: 241801 Total bytes read: 197836829 Total msg lost by read: 27517 Total DROP_NO_MATCH_FILE 27517 Total files received from DP: 2155 Counters for file cancellation: CANCEL_BY_DP 31 CANCEL_TIME_OUT 4 CANCEL_FILE_DUP_EARLY 32 CANCEL_FILE_DUP 647 CANCEL_FILESIZE_LIMIT 93 CANCEL_CONCURRENT_LIMIT 15 Counters for file forwarding: file type: apk FWD_CNT_LOCAL_FILE 1 FWD_CNT_REMOTE_DUP_CLEAN 1 file type: pdf FWD_CNT_LOCAL_FILE 64 FWD_CNT_LOCAL_DUP 12 FWD_CNT_REMOTE_FILE 55 FWD_CNT_REMOTE_DUP_CLEAN 13 FWD_CNT_REMOTE_DUP_TBD 3 file type: email-link FWD_CNT_LOCAL_FILE 48 FWD_CNT_APPENDED_BATCH 49 file type: ms-office FWD_CNT_LOCAL_FILE 28 FWD_CNT_LOCAL_DUP 22 FWD_CNT_REMOTE_FILE 27 FWD_CNT_REMOTE_DUP_CLEAN 9 FWD_CNT_REMOTE_DUP_TBD 10 file type: pe FWD_CNT_LOCAL_FILE 46 FWD_CNT_LOCAL_DUP 15 FWD_CNT_LOCAL_FILE_CLEAN 25 FWD_CNT_REMOTE_FILE 3 FWD_CNT_REMOTE_DUP_CLEAN 55 FWD_CNT_CACHE_SYNC 1 file type: flash FWD_CNT_LOCAL_FILE 1120 FWD_CNT_LOCAL_DUP 598 FWD_CNT_REMOTE_FILE 519 FWD_CNT_REMOTE_DUP_CLEAN 907 FWD_CNT_REMOTE_DUP_TBD 39 FWD_CNT_REMOTE_DUP_MAL 9 FWD_CNT_CACHE_SYNC 4 file type: jar file type: unknown file type: pdns Error counters: FWD_ERR_CONN_FAIL 4 LOG_ERR_REPORT_CACHE_NOMATCH 198237 Reset counters: DP receiver reset cnt: 1 File cache reset cnt: 1 Service connection reset cnt: 1 Log cache reset cnt: 1 Report cache reset cnt: 1 Resource meters: data_buf_meter 0% msg_buf_meter 0% ctrl_msg_buf_meter 0% File forwarding queues: priority: 1, size: 0 priority: 2, size: 0 priority: 3, size: 0 @Hardik: The file blocking profile is set to "forward" @Hari:that's an interesting point, so this is relevant only to unknown applications not seen by WildFire? Because what I have understood, and also my customer, is for every suspect application, we will get an email alert from device with this. Regards, Renan
... View more