About rled

Hello my configuration is fine, other suspect files are send to WF, and on this specific function in the screnshot, you can see that "wildfire-upload-success" is the action. For other questions: > show wildfire status Connection info:   Wildfire cloud:                public cloud   Status:                        Idle   Best server:                   eu-s1.wildfire.paloaltonetworks.com   Device registered:             yes   Valid wildfire license:        yes   Service route IP address:      62.23.197.100   Signature verification:        enable   Server selection:              enable   Through a proxy:               no File size limit info:   pe                                           2 MB   apk                                         10 MB   pdf                                        400 KB   ms-office                                  500 KB   jar                                          1 MB   flash                                        5 MB Forwarding info:   file idle time out (second):                          90   total file forwarded:                                647   file forwarded in last minute:                         0   concurrent files:                                      0 > show wildfire statistics Packet based counters:         Total msg rcvd:                         269318         Total bytes rcvd:                    224453980         Total msg read:                         241801         Total bytes read:                    197836829         Total msg lost by read:                  27517         Total DROP_NO_MATCH_FILE                 27517 Total files received from DP: 2155 Counters for file cancellation:         CANCEL_BY_DP                                31         CANCEL_TIME_OUT                              4         CANCEL_FILE_DUP_EARLY                       32         CANCEL_FILE_DUP                            647         CANCEL_FILESIZE_LIMIT                       93         CANCEL_CONCURRENT_LIMIT                     15 Counters for file forwarding:         file type: apk                 FWD_CNT_LOCAL_FILE                           1                 FWD_CNT_REMOTE_DUP_CLEAN                     1         file type: pdf                 FWD_CNT_LOCAL_FILE                          64                 FWD_CNT_LOCAL_DUP                           12                 FWD_CNT_REMOTE_FILE                         55                 FWD_CNT_REMOTE_DUP_CLEAN                    13                 FWD_CNT_REMOTE_DUP_TBD                       3         file type: email-link                 FWD_CNT_LOCAL_FILE                          48                 FWD_CNT_APPENDED_BATCH                      49         file type: ms-office                 FWD_CNT_LOCAL_FILE                          28                 FWD_CNT_LOCAL_DUP                           22                 FWD_CNT_REMOTE_FILE                         27                 FWD_CNT_REMOTE_DUP_CLEAN                     9                 FWD_CNT_REMOTE_DUP_TBD                      10         file type: pe                 FWD_CNT_LOCAL_FILE                          46                 FWD_CNT_LOCAL_DUP                           15                 FWD_CNT_LOCAL_FILE_CLEAN                    25                 FWD_CNT_REMOTE_FILE                          3                 FWD_CNT_REMOTE_DUP_CLEAN                    55                 FWD_CNT_CACHE_SYNC                           1         file type: flash                 FWD_CNT_LOCAL_FILE                        1120                 FWD_CNT_LOCAL_DUP                          598                 FWD_CNT_REMOTE_FILE                        519                 FWD_CNT_REMOTE_DUP_CLEAN                   907                 FWD_CNT_REMOTE_DUP_TBD                      39                 FWD_CNT_REMOTE_DUP_MAL                       9                 FWD_CNT_CACHE_SYNC                           4         file type: jar         file type: unknown         file type: pdns Error counters:         FWD_ERR_CONN_FAIL                            4         LOG_ERR_REPORT_CACHE_NOMATCH            198237 Reset counters:         DP receiver reset cnt:                       1         File cache reset cnt:                        1         Service connection reset cnt:                1         Log cache reset cnt:                         1         Report cache reset cnt:                      1 Resource meters:         data_buf_meter                               0%         msg_buf_meter                                0%         ctrl_msg_buf_meter                           0% File forwarding queues:         priority: 1,  size: 0         priority: 2,  size: 0         priority: 3,  size: 0 @Hardik: The file blocking profile is set to "forward" @Hari:that's an interesting point, so this is relevant only to unknown applications not seen by WildFire? Because what I have understood, and also my customer, is for every suspect application, we will get an email alert from device with this. Regards, Renan ... View more

Hello Hari, Yes, I do not see the Wildfire submission in the WF logs, neither in the portal for this activity. Other WF threats are correctly send. Maybe a missconfiguration? I have just followed the KB: WildFire Email Alerts: Subscribe or Add Additional Recipients @Hulk: I have tried, but not receiving email. Regards, Renan ... View more

Hello Hulk, I have check and enable notifications from WF portal, and it works. But from my understanding, when a suspicious link is present in an email, the device is supposed to send an alert message through smtp, right? Regards, Renan ... View more