Advanced WildFire Analysis Reports—Close Up
Where Can I Use
This? | What Do I Need? |
|---|---|
|
|
Access Advanced WildFire analysis reports on the firewall, the WildFire portal,
and the WildFire API.
Advanced WildFire analysis reports display detailed sample information,
as well as information on targeted users, email header information
(if enabled), the application that delivered the file, and all URLs
involved in the command-and-control activity of the file. Advanced
WildFire reports contain some or all of the information described
in the following table based on the session information configured
on the firewall that forwarded the file and depending on the observed
behavior for the file.
When viewing an Advanced WildFire report for a file that
was manually uploaded to the WildFire portal or by using the WildFire API,
the report will not show session information because the traffic
did not traverse the firewall. For example, the report would not
show the Attacker/Source and Victim/Destination.
Report Heading | Description |
|---|---|
File Information |
|
Coverage Status | Click the Virus Total link
to view endpoint antivirus coverage information for samples that
have already been identified by other vendors. If the file has never
been seen by any of the listed vendors, file not found appears.In
addition, when the report is rendered on the firewall, up-to-date
information about what signature and URL filtering coverage that
Palo Alto Networks currently provides to protect against the threat
will also be displayed in this section. Because this information
is retrieved dynamically, it will not appear in the PDF report. The
following coverage information is provided for active signatures:
|
Session Information | Contains session information based on the
traffic as it traversed the firewall that forwarded the sample.
To define the session information that WildFire will include in
the reports, select . The following
options are available:
By default, session information
includes the field Status, which indicates if the firewall allowed
or blocked the sample. |
Dynamic Analysis | If a file is low risk and WildFire can easily
determine that it is safe, only static analysis is performed on
the file, instead of dynamic analysis. When dynamic analysis
is performed, this section contains tabs showing analysis results
for each environment type that the sample was run in. For example, the
Virtual Machine 4 tab might show an analysis environment operating
Windows 7, Adobe Reader 11, Flash 11, and Office 2010. On
the WildFire appliance, only one virtual machine is used for the
analysis, which you select based on analysis environment attributes
that best match your local environment. For example, if most users
have Windows 7 32-bit, that virtual machine would be selected. |
Behavior Summary | Each Virtual Machine tab summarizes the
behavior of the sample file in the specific environment. Examples include
whether the sample created or modified files, started a process,
spawned new processes, modified the registry, or installed browser
helper objects. The Severity column indicates the severity
of each behavior. The severity gauge will show one bar for low severity
and additional bars for higher severity levels. This information
is also added to the dynamic and static analysis sections.  The following
describes the various behaviors that are analyzed:
|
Submit Malware | Use this option to manually submit the sample
to Palo Alto Networks. The WildFire cloud will then re-analyze the sample
and generate a signatures if it determines that the sample is malicious.
This is useful on a WildFire appliance that does not have signature
generation or cloud intelligence enabled, which is used to forward
malware from the appliance to the WildFire cloud. |
Report an Incorrect Verdict | Click this link to submit the sample to
the Palo Alto Networks threat team if you feel the verdict is a
false positive or false negative. The threat team will perform further
analysis on the sample to determine if it should be reclassified.
If a malware sample is determined to be safe, the signature for
the file is disabled in an upcoming antivirus signature update or
if a benign file is determined to be malicious, a new signature
is generated. After the investigation is complete, you will receive
an email describing the action that was taken. |
