Focus

Advanced WildFire

show wildfire

Table of Contents

show wildfire

Description

Shows various information about the WildFire appliance, such global and local device and sample-related details, appliance status, , and the virtual machine that is selected to perform analysis.

Hierarchy Location

show wildfire

Syntax

status | vm-images | wf-vm-pe-utilization | wf-vm-doc-utilization | wf-vm-email-link-utilization | wf-vm-archive-utilization | wf-sample-queue-status
				}

Options

> status

— Display the status of the appliance as well as configuration information such as the Virtual Machine (VM) used for sample analysis, whether or not samples/reports are sent to the cloud, vm network, and registration information.

> vm-images

— Display the attributes of the available virtual machine images used for sample analysis. To view the current active image, run the following command:

admin@WF-500>
					show wildfire status

and view the

VM field

> wf-sample-queue-status

— Displays the number and breakdown of WildFire appliance samples that are waiting to be analyzed.

> wf-vm-doc-utilization

— Displays how many analysis environments used to process document files are available and are in use.

> wf-vm-elinkda-utilization

— Displays how many analysis environments used to process email links are available and are in use.

> wf-vm-pe-utilization

— Displays how many analysis environments used to process portable executable files are available and are in use.

Sample Output

The following shows the output for this command.

admin@WF-500>
				show
					wildfire status
				Connection info:
				Wildfire cloud:                s1.wildfire.paloaltonetworks.com
				Status:                        Idle
				Submit sample:                 disabled
				Submit report:                 disabled
				Selected VM:                   vm-5
				VM internet connection:        disabled
				VM network using Tor:          disabled
				Best server:                   s1.wildfire.paloaltonetworks.com
				Device registered:             yes
				Service route IP address:      10.3.4.99
				Signature verification:        enable
				Server selection:              enable
				Through a proxy:               no

				admin@WF-500>
				show wildfire vm-images

				Supported VM images:
				vm-1
				Windows XP, Adobe Reader 9.3.3, Flash 9, Office 2003. Support PE, PDF, Office 2003 and earlier
				vm-2
				Windows XP, Adobe Reader 9.4.0, Flash 10n, Office 2007. Support PE, PDF, Office 2007 and earlier
				vm-3
				Windows XP, Adobe Reader 11, Flash 11, Office 2010. Support PE, PDF, Office 2010 and earlier
				vm-4
				Windows 7 32bit, Adobe Reader 11, Flash 11, Office 2010. Support PE, PDF, Office 2010 and earlier
				vm-5
				Windows 7 64bit, Adobe Reader 11, Flash 11, Office 2010. Support PE, PDF, Office 2010 and earlier
				vm-6
				Windows XP, Internet Explorer 8, Flash 11. Support E-MAIL Links
				
				admin@WF-500>
				show wildfire wf-sample-queue-status
				DW-ARCHIVE: 4,
				DW-DOC: 2,
				DW-ELINK: 0,
				DW-PE: 21,
				DW-URL_UPLOAD_FILE: 2,
				
				admin@WF-500>
				show wildfire wf-vm-pe-utilization
				{
				available: 2,
				in_use: 1,
				}

Required Privilege Level

superuser, superreader

submit wildfire local-verdict-change

show wildfire global