Configure Traps to Analyze Executable Files

1. Verify that the ESM components are configured to communicate with WildFire.
   See Set Up the ESM to Communicate with WildFire.
2. Configure a new WildFire rule.
   1. Select PoliciesMalwareWildFire.
   2. Click the tab for the type of endpoint OS, either Windows or macOS.
   3. From the action menu
      , select Add.
   4. Select Executable Files.
3. To activate the WildFire module to enable Traps to calculate and check hash verdicts for executable files against its local cache of hashes, set Activation to On.
4. Configure the Action—the behavior of Traps—when Traps identifies malware.
   • Select Inherit to inherit the behavior from the preceding rule in the rule hierarchy.
   • Select Prevention to block the malicious file.
   • Select Notification to allow the user to open the file, log the issue, and notify the user about the malicious file.
   • Select Learning to allow the user to open a malicious file and silently log the issue without notifying the user.
5. Specify whether Traps will notify the user about the malicious file.
   From the User Alert drop-down, select On to notify the user or Off to silently log the event.
6. To exempt a file from WildFire examination, add the file to the whitelist.
   Whitelisting files can be useful if the associated hash value changes but the filename stays the same. For example, consider an application such as GoToMeeting which creates a new executable file with the same filename and a unique hash value each time you launch the application. In this case, to exempt GoToMeeting from WildFire examination, you can add the full path for GoToMeeting.exe to the whitelist.

   If you do not expect the hash value associated with a file to change and want to whitelist the file, we recommend that you configure an administrative hash override for the verdict.
   1. Click the
      icon above the Whitelist.
   2. Add the Full Path to the file. Traps will ignore executables or macros run from the specified files at these paths.
      The whitelist also supports the same environment variables and wildcards that you can use in restriction rules. For example, to allow a file at path C:\temp\myfilename.exe to run, add the path to the whitelist. Or to allow myfilename.exe to run regardless of where myfilename.exe is stored, you can use wildcards to define the full path as *\myfilename.exe.
   3. Repeat this process to specify additional files.
   4. Select the Whitelist Action to Merge or Override the whitelist with lists defined in other user-defined or default policy rules.
      • If multiple rules specify List Action: Merge, Traps consolidates the Whitelist.
      • If multiple rules specify List Action: Override, only the most recent rule (with the highest ID number) takes precedence.
7. Configure the WildFire integration behavior for executable files:
   To get the most out of WildFire integration, we recommend that you turn on all WildFire functionality.

   • Upload Files for WildFire Analysis—Set this value to On to enable Traps to send unknown executable files to the ESM, which sends the files to WildFire for analysis.
   • Apply Malware Verdict on Grayware—Set this option to On to treat all grayware as malware. Otherwise, if this option is Off, grayware is considered benign and is not blocked.
   • Enable Local Analysis on Unknown Files—Set this option to On to enable Traps to use embedded machine learning to determine the likelihood that an unknown executable file is malware and issue a local verdict for the file. When this option is Off and is configured to block unknown files, users will not be permitted to open unknown executable files. As a result, the unknown file remains blocked until Traps receives an official WildFire verdict.
   • Quarantine Prevented Files—Set this option to On to enable Traps to quarantine malware on the endpoint. A file is considered malware if one of the following sources issued a malware verdict for the file: WildFire, administrative policy override, or local analysis. Set this option to Off to allow malware to remain on the endpoint in its original location. The quarantine feature is not available for malware identified in network drives.
   • WildFire Verdict is Unavailable—Set this option to Block Unknowns or Allow Unknowns when the file is unknown in the local and server cache.
     By default Traps permits unknown executable files to open; however, if local analysis is enabled, Traps always returns a verdict for an unknown executable file. Therefore, enabling these options files only applies to agents for which local analysis is not enabled.
   • ESM Unreachable—Set this option to Block Unknowns or Allow Unknowns (default) when Traps cannot reach the ESM Server to query for a verdict or submit the file for analysis.
8. (Optional) Add Conditions to the rule. By default, a new rule does not contain any conditions.
   To specify a condition, select the Conditions tab, select the condition in the Conditions list, and then Add it to the Selected Conditions list. Repeat this step to add more conditions, as needed. You can also define new Conditions.
9. (Optional) Define the Target Objects to which to apply the rule.
   To define a smaller subset of target objects, select the Objects tab, and then enter one or more AD Users, AD Computers, AD Groups, AD Organizational Unit, Existing Endpoints, or Existing Groups in the Include or Exclude areas. The Endpoint Security Manager queries Active Directory to verify the users, computers, groups, or organizational units. The ESM Console also offers autocompletion as you type for existing endpoints and existing virtual groups.
10. (Optional) Review the rule name and description. The ESM Console automatically generates the rule name and description based on the rule details but permits you to change these fields, if needed.
    To override the autogenerated name, select the Name tab, clear the Activate automatic description option, and then enter a rule name and description of your choice.
11. Save the WildFire rule.
    Do either of the following:

    • Save the rule without activating it. This option is only available for inactive, cloned, or new rules. When you are ready to activate the rule, select the rule from the PoliciesMalwareWildFire page and then click Activate.
    • Apply the rule to activate it immediately.

    After saving or applying a rule, you can return to the WildFire page at any time to Delete or Deactivate the rule.