WildFire

PCNSA Training By Vintcom Myanmar

• Palo Alto Networks firewalls across the world automatically forward
unknown files and URL links found in emails to the WildFire global
threat intelligence cloud or to one of three WildFire regional clouds in
Europe, Japan, and Singapore for analysis.
WildFire
• Each WildFire cloud analyzes samples and generates malware
signatures and verdicts independently of the other WildFire clouds.
• WildFire signatures and verdicts then are shared globally, which
enables WildFire users worldwide to benefit from malware coverage.
• Licensed WildFire users worldwide also can use the WildFire XML
API or WildFire Dashboard to manually upload files to WildFire for
analysis.
• WildFire is a cloud-based, virtual sandbox used to evaluate unknown
files and URL links found in emails.
• After analysis is complete, files and links are labeled as benign,
grayware, malware, or phishing.
• WildFire creates a new antivirus signature or adds the URL to the
PAN-DB Phishing URL category
• Then these updates are made available within minutes for download
by firewalls around the world.
WildFire Operation Overview
WildFire Verdict Descriptions

• File verdicts appear in the web interface WildFire Submissions log and in the WildFire portal.
• WildFire Verdict Results
• Benign
• A benign verdict is given by WildFire to files or URLs that have been found to be safe and pose no threat to your organization. Safe and does not exhibit malicious
behavior.
• Grayware
• The grayware verdict was introduced in PAN-OS 7.0 to clearly identify executables that behave similarly to malware but are not malicious in nature or intent. Antivirus
signatures are not generated for grayware, but you can configure your firewall to log grayware events to assess whether such events warrant further action.
• Malware
• A malware verdict indicates that WildFire has determined that the file or URL is malicious in nature and intent and can pose a security threat to your organization.
• Phishing
• Beginning with PAN-OS 8.0, the phishing verdict was introduced to classify phishing links found in emails separately from emailed links found to be exploits or
malware. Phishing links are added to the PAN-DB database and are used to block future phishing attacks.
WildFire Updates

• WildFire analysis is used to create new antivirus

signatures. It also is used to update the URLs and URL
categories listed in the PAN-DB URL Filtering database.
• Antivirus signatures are made available within 24 to 48
hours as content updates to the Antivirus content
database. You can schedule daily downloads of the
Antivirus content database. (Requires Threat Prevention
license)
• URL updates are made available within 5 minutes as
content updates to the PAN-DB URL Filtering database.
You do not need to schedule PAN-DB downloads,
because new URL information is downloaded
dynamically by the firewall as needed. (Requires URL
Filtering license)
• Antivirus signatures are made available in real-time as
content updates to the WildFire signatures content
database on the firewall. You can schedule a firewall to
check for new WildFire Antivirus signatures in real-
time. (Requires WildFire license)
 Standard and Licensed Functionality

Every type of Palo Alto Networks firewall with a Threat Prevention license has access to the standard WildFire subscription service.

Standard Subscription Service WildFire Licensed Service

• Analysis available in Windows XP, 7, 10, macOS, Android,
Linux, and bare metal
• Windows PE file types such as EXE, DLL, SCR, and FON
• Antivirus signatures delivered via daily dynamic content updates
(requires Threat Prevention license)
• Automatic file submission
• All of standard subscription features and additional features
• Additional file types such as Microsoft Office files, PDF files,
Java JAR and CLASS files, Adobe Flash SWF and SWC files,
RAR, 7-Zip, Linux ELF, Android APK files, the macOS Mach-O,
DMG, PKG files, JS, VBS, and PS1 files
• WildFire can create new signatures every 5 minutes so near real-
time protection against the latest threats detected anywhere in the
world

• A license also enables users to programmatically submit files for

analysis to WildFire using the WildFire XML API
 WildFire Private Cloud

• The WF-500 appliance is a WildFire private cloud solution.

• With the release of PAN-OS 10.0, the WF-500 supports Windows XP, Windows 7, and
Windows 10 virtual environments.
• With the addition of Windows 10 support, the WF-500 increases the threat prevention
coverage of the appliance by enabling it to detect threats crafted for Windows 10
environments.
• The WF-500 appliance analyzes files forwarded from your Palo Alto Networks firewalls or
from the WildFire XML API.
• By default, the WF-500 appliance never sends malware files outside of your network.
• However, you can choose to automatically forward malware files to the WildFire public cloud
for signature generation.
• You also can choose to send a malware report but not the actual file.
• The WF-500 appliance supports the WildFire XML API.
Configure WildFire
Settings

• To configure WildFire settings on the

firewall, browse to Device > Setup >
WildFire.
• If you configure SSL or SSH decryption,
the firewall will not send any decrypted
content to the Wildfire for analysis unless
you enable the settings under Device >
Setup > Content-ID > Content-ID
Settings and check Allow forwarding of
decrypted content.
WildFire Analysis Profile

• WildFire Analysis Profiles are objects that are added to Security policy rules that are configured with an action of “allow.”
• WildFire Analysis Profiles are not necessary for Security policy rules configured with the “deny” action, because no further
processing is needed if the network traffic will be blocked.
• The WildFire Analysis Profiles represent additional security checks to be performed on files in allowed network traffic.
• The files submitted to WildFire are logged to the log found at Monitor > Logs > WildFire Submissions.
Configure Real-Time WildFire Analysis

• To configure real-time WildFire analysis on the firewall, you create a new or update an existing Antivirus Security Profile to use the
WildFire analysis classification engine.
• Next, you define a policy action for each classification engine that you added to the Antivirus Profile.
 WildFire Reporting

• WildFire reports its findings to the firewall each time that its
technology analyzes a file or URL link.
• You can configure both the types of information submitted to
WildFire and the amount of information that is returned to the
firewall in the report.
Verify Submissions

• To verify successful file upload to WildFire, use the CLI • In the web interface, go to Monitor > Logs > WildFire
and enter the command debug wildfire upload-log show. Submissions
View WildFire Analysis Report

• View WildFire analysis report at Monitor > Logs > WildFire Submissions.
Report Incorrect Verdict: Web Interface

• WildFire reports indicate whether WildFire analysis showed a file to be

benign, grayware, or malware.
• If you think that a file was incorrectly categorized by WildFire, you can use
the web interface or the WildFire portal to request a new verdict from Palo
Alto Networks.
• Step 1: Select Monitor > Logs > WildFire Submissions.
• Step 2: Find entry and click its detailed view icon.
• Step 3: Click WildFire Analysis Report tab.
• Step 4: Click Select Incorrect Verdict link.
• Step 5: Suggest new verdict.
WildFire Portal

• Results of the detailed analysis of the submitted files are available through the WildFire portal.
• To access the WildFire portal, go to the Palo Alto Networks WildFire website (https://wildfire.paloaltonetworks.com) and log in using
your Palo Alto Networks Support credentials or your WildFire account.
Thank You