Include Email Header Information in WildFire Logs and Reports

Table of Contents

Enable Logging for Benign and Grayware Samples

Include Email Header Information in WildFire Logs and Reports

Where Can I Use This?	What Do I Need?
NGFW (Managed by PAN-OS or Panorama) VM-Series CN-Series	Advanced WildFire License

Use the following steps to include email header information—email sender, recipient(s), and subject—in WildFire logs and reports.

Session information is forwarded to the WildFire cloud along with the sample, and used to generate the WildFire analysis report. Neither the firewall nor the WildFire cloud receive, store, or view actual email contents.

Session information can help you to quickly track down and remediate threats detected in email attachments or links, including how to identify recipients who have downloaded or accessed malicious content.

Select DeviceSetupWildFire.
Edit the Session Information Settings section and enable one or more of the options (Email sender, Email recipient, and Email subject).
Click OK to save.

Enable Logging for Benign and Grayware Samples

Set Up Alerts for Malware