About rled

Hello my configuration is fine, other suspect files are send to WF, and on this specific function in the screnshot, you can see that "wildfire-upload-success" is the action. For other questions: > show wildfire status Connection info:   Wildfire cloud:                public cloud   Status:                        Idle   Best server:                   eu-s1.wildfire.paloaltonetworks.com   Device registered:             yes   Valid wildfire license:        yes   Service route IP address:      62.23.197.100   Signature verification:        enable   Server selection:              enable   Through a proxy:               no File size limit info:   pe                                           2 MB   apk                                         10 MB   pdf                                        400 KB   ms-office                                  500 KB   jar                                          1 MB   flash                                        5 MB Forwarding info:   file idle time out (second):                          90   total file forwarded:                                647   file forwarded in last minute:                         0   concurrent files:                                      0 > show wildfire statistics Packet based counters:         Total msg rcvd:                         269318         Total bytes rcvd:                    224453980         Total msg read:                         241801         Total bytes read:                    197836829         Total msg lost by read:                  27517         Total DROP_NO_MATCH_FILE                 27517 Total files received from DP: 2155 Counters for file cancellation:         CANCEL_BY_DP                                31         CANCEL_TIME_OUT                              4         CANCEL_FILE_DUP_EARLY                       32         CANCEL_FILE_DUP                            647         CANCEL_FILESIZE_LIMIT                       93         CANCEL_CONCURRENT_LIMIT                     15 Counters for file forwarding:         file type: apk                 FWD_CNT_LOCAL_FILE                           1                 FWD_CNT_REMOTE_DUP_CLEAN                     1         file type: pdf                 FWD_CNT_LOCAL_FILE                          64                 FWD_CNT_LOCAL_DUP                           12                 FWD_CNT_REMOTE_FILE                         55                 FWD_CNT_REMOTE_DUP_CLEAN                    13                 FWD_CNT_REMOTE_DUP_TBD                       3         file type: email-link                 FWD_CNT_LOCAL_FILE                          48                 FWD_CNT_APPENDED_BATCH                      49         file type: ms-office                 FWD_CNT_LOCAL_FILE                          28                 FWD_CNT_LOCAL_DUP                           22                 FWD_CNT_REMOTE_FILE                         27                 FWD_CNT_REMOTE_DUP_CLEAN                     9                 FWD_CNT_REMOTE_DUP_TBD                      10         file type: pe                 FWD_CNT_LOCAL_FILE                          46                 FWD_CNT_LOCAL_DUP                           15                 FWD_CNT_LOCAL_FILE_CLEAN                    25                 FWD_CNT_REMOTE_FILE                          3                 FWD_CNT_REMOTE_DUP_CLEAN                    55                 FWD_CNT_CACHE_SYNC                           1         file type: flash                 FWD_CNT_LOCAL_FILE                        1120                 FWD_CNT_LOCAL_DUP                          598                 FWD_CNT_REMOTE_FILE                        519                 FWD_CNT_REMOTE_DUP_CLEAN                   907                 FWD_CNT_REMOTE_DUP_TBD                      39                 FWD_CNT_REMOTE_DUP_MAL                       9                 FWD_CNT_CACHE_SYNC                           4         file type: jar         file type: unknown         file type: pdns Error counters:         FWD_ERR_CONN_FAIL                            4         LOG_ERR_REPORT_CACHE_NOMATCH            198237 Reset counters:         DP receiver reset cnt:                       1         File cache reset cnt:                        1         Service connection reset cnt:                1         Log cache reset cnt:                         1         Report cache reset cnt:                      1 Resource meters:         data_buf_meter                               0%         msg_buf_meter                                0%         ctrl_msg_buf_meter                           0% File forwarding queues:         priority: 1,  size: 0         priority: 2,  size: 0         priority: 3,  size: 0 @Hardik: The file blocking profile is set to "forward" @Hari:that's an interesting point, so this is relevant only to unknown applications not seen by WildFire? Because what I have understood, and also my customer, is for every suspect application, we will get an email alert from device with this. Regards, Renan ... View more

Hello Hari, Yes, I do not see the Wildfire submission in the WF logs, neither in the portal for this activity. Other WF threats are correctly send. Maybe a missconfiguration? I have just followed the KB: WildFire Email Alerts: Subscribe or Add Additional Recipients @Hulk: I have tried, but not receiving email. Regards, Renan ... View more

Hello Hulk, I have check and enable notifications from WF portal, and it works. But from my understanding, when a suspicious link is present in an email, the device is supposed to send an alert message through smtp, right? Regards, Renan ... View more

Ok, thank you guys, will ask customer to check   And after I will open a case to have the confirmation and a corrected version for next update. Regards, Renan ... View more