WildFire Inline ML

WildFire inline ML prevents malicious content in real-time using machine learning on the firewall.
You can now prevent malicious variants of portable executables and PowerShell scripts from entering your network in real-time using machine learning (ML) on the firewall dataplane. By utilizing WildFire
®
Cloud analysis technology on the firewall, WildFire Inline ML dynamically detects malicious files of a specific type by evaluating various file details, including decoder fields and patterns, to formulate a high probability classification of a file. This protection extends to currently unknown as well as future variants of threats that match characteristics that Palo Alto Networks identified as malicious. WildFire inline ML complements your existing Antivirus profile protection configuration and requires an active WildFire subscription. Additionally, you can specify file hash exceptions to exclude any false-positives that you encounter, which enables you to create more granular rules in your profiles to support your specific security needs.
WildFire inline ML is not supported on the VM-50 or VM50L virtual appliance.
  1. To take advantage of WildFire inline ML, you must have an active WildFire subscription to analyze Windows executables.
    Verify that you have a WildFire subscription. To verify subscriptions for which you have currently-active licenses, select
    Device
    Licenses
    and verify that the appropriate licenses display and are not expired.
  2. Create a new or update your existing Antivirus Security profiles to use the real-time WildFire analysis classification engine.
    1. Select an existing
      Antivirus Profile
      or
      Add
      a new one (
      Objects > Security Profiles > Antivirus
      ).
    2. Configure your Antivirus profile.
    3. Select
      WildFire Inline ML
      and apply an
      Action Setting
      for each WildFire inline ML model. This enforces WildFire inline ML Actions settings for each protocol on a per-model basis. There are three classification engines: Windows Executables, PowerShell Scripts 1, and PowerShell Scripts 2.
      • enable (inherit per-protocol actions)
        —WildFire inspects traffic according to your selections in the WildFire Inline ML Action column in the decoders section of the
        Action
        tab.
      • alert-only (override more strict actions to alert)
        —WildFire inspects traffic according to your selections in the WildFire Inline ML Action column in the decoders section of the
        Action
        tab and overrides any action with a severity level higher than
        alert
        (
        drop
        ,
        reset-client
        ,
        reset-server
        ,
        reset-both
        )
        alert
        , which allows traffic to pass while still generating and saving an alert in the threat logs.
      • disable (for all protocols)
        —WildFire allows traffic to pass without any policy action.
    4. Click
      OK
      to exit the Antivirus Profile configuration dialog and
      Commit
      your new settings.
  3. (
    Optional
    ) Add file exceptions to your Antivirus Security profile if you encounter false-positives. You can add the file exception details directly to the exception list or by specifying a file from the threat logs.
    • Add file exceptions directly to the exceptions list.
      1. Select
        Objects > Security Profiles > Antivirus
        .
      2. Select an Antivirus profile for which you want to exclude specific files and then select
        WildFire Inline ML
        .
      3. Add the hash, filename, and description of the file that you want to exclude from enforcement.
      4. Click
        OK
        to save the Antivirus profile and then
        Commit
        your changes.
    • Add file exceptions from threat logs entries.
      1. Select
        Monitor > Logs > Threat
        and filter the logs for the
        ml-virus
        threat type. Select a threat log for a file for which you wish to create a file exception.
      2. Go to the
        Detailed Log View
        and scroll to
        Details
        and then
        Create Exception
        .
      3. Add a
        Description
        and click
        OK
        to add the file exception.
      4. You can find the new file exception in the
        File Exceptions
        list (
        Objects
        Security Profiles
        Antivirus
        WildFire Inline ML
        .
  4. (Optional)
    See Configure WildFire Inline ML for information about testing your firewall’s connection to the inline ML cloud service and viewing related logs.

Recommended For You