WildFire Integration
Table of Contents
4.2 (EoS)
Expand all | Collapse all
-
- Set Up the Endpoint Infrastructure
- Activate Traps Licenses
-
- Endpoint Infrastructure Installation Considerations
- TLS/SSL Encryption for Traps Components
- Configure the MS-SQL Server Database
- Install the Endpoint Security Manager Server Software
- Install the Endpoint Security Manager Console Software
- Manage Proxy Communication with the Endpoint Security Manager
- Load Balance Traffic to ESM Servers
-
- Malware Protection Policy Best Practices
- Malware Protection Flow
- Manage Trusted Signers
-
- Remove an Endpoint from the Health Page
- Install an End-of-Life Traps Agent Version
-
-
- Traps Troubleshooting Resources
- Traps and Endpoint Security Manager Processes
- ESM Tech Support File
-
- Access Cytool
- View the Status of the Agent Using Cytool
- View Processes Currently Protected by Traps Using Cytool
- Manage Logging of Traps Components Using Cytool
- Restore a Quarantined File Using Cytool
- View Statistics for a Protected Process Using Cytool
- View Details About the Traps Local Analysis Module Using Cy...
- View Hash Details About a File Using Cytool
WildFire Integration
WildFire is
the Palo Alto Networks sandbox solution for analyzing unfamiliar
files—including unknown executable files. WildFire issues verdicts
for all scrutinized files: benign in the case of a safe file and
malicious in the case of malware. The WildFire integration with
Traps is an optional service that incorporates WildFire analysis
into your Traps endpoint solution.
When a user or a machine tries to open an executable file or
macro on the endpoint, Traps calculates a unique identifier (known
as a hash) using the SHA-256 algorithm. The ESM Server
then checks it against the WildFire database. If WildFire confirms
that a file is known malware, Traps blocks the file and notifies
the Endpoint Security Manager (for more information, see Manage
Hashes for Executable Files).