Device > Setup > WildFire
Select DeviceSetupWildFire to configure WildFire settings on the firewall and Panorama. You can enable both the WildFire cloud and a WildFire appliance to be used to perform file analysis. You can also set file size limits and session information that will be reported. After populating WildFire settings, you can specify what files to forward to the WildFire cloud or the WildFire appliance by creating a WildFire Analysis profile (ObjectsSecurity ProfilesWildFire Analysis).
To forward decrypted content to WildFire, refer to Forward Decrypted SSL Traffic for WildFire Analysis.
WildFire Public Cloud
Enter wildfire.paloaltonetworks.com to send files to the WildFire global cloud, hosted in the United States, for analysis. Alternatively, you can instead send files to aWildFire regional cloud for analysis. Regional clouds are designed to adhere to the data privacy expectations you might have depending on your location.
Forward samples to a regional WildFire cloud to ensure adherence to the data privacy and compliance standards specific to your region. Regional clouds are:
WildFire Private Cloud
Specify the IP address or FQDN of the WildFire appliance.
The firewall sends files for analysis to the specified WildFire appliance.
Panorama collects threat IDs from the WildFire appliance to enable the addition of threat exceptions in Anti-Spyware profiles (for DNS signatures only) and Antivirus profiles that you configure in device groups. Panorama also collects information from the WildFire appliance to populate fields that are missing in the WildFire Submissions logs received from firewalls running software versions earlier than PAN-OS 7.0.
File Size Limits
Specify the maximum file size that will be forwarded to the WildFire server. For all best practice recommendations about file size limits, if the limit is too large and prevents the firewall from forwarding multiple large zero-day files at the same time, lower and tune the maximum limit based on the amount of available firewall buffer space. If more buffer space is available, you can increase the file size limit above the best practice recommendation. The best practice recommendations are a good starting place for setting effective limits that don’t overtax firewall resources. Available ranges are:
The preceding values might differ based on the current version of PAN-OS or the content release. To see valid ranges, click in the Size Limit field; a pop-up displays the available range and default value.
Report Benign Files
When this option is enabled (disabled by default), files analyzed by WildFire that are determined to be benign will appear in the MonitorWildFire Submissions log.
Even if this option is enabled on the firewall, email links that WildFire deems benign will not be logged because of the potential quantity of links processed.
Report Grayware Files
When this option is enabled (disabled by default), files analyzed by WildFire that are determined to be grayware will appear in the MonitorWildFire Submissions log.
Even if this option is enabled on the firewall, email links that WildFire determines to be grayware will not be logged because of the potential quantity of links processed.
Enable reporting grayware files to log session information, network activity, host activity, and other information that helps with analytics.
Session Information Settings
Specify the information to be forwarded to the WildFire server. By default, all are selected and the best practice is to forward all session information to provide statistics and other metrics that enable you to take actions to prevent threat events:
Verify File Forwarding
Verify File Forwarding After the firewall is set up to Forward Files for WildFire Analysis , use the following options to verify the connection between ...
Forward Files for WildFire Analysis
Forward Files for WildFire Analysis Configure Palo Alto Networks firewalls to forward unknown files or email links and blocked files that match existing antivirus signatures ...
Enable Logging for Benign and Grayware Samples
Enable Logging for Benign and Grayware Samples Logging for benign and grayware samples is disabled by default. Email links that receive benign or grayware verdicts ...
Enable Basic WildFire Forwarding
Enable Basic WildFire Forwarding WildFire is a cloud-based virtual environment that analyzes and executes unknown samples (files and email links) and determines the samples to ...
WildFire Global Cloud
WildFire Global Cloud A Palo Alto Networks firewall with can forward unknown files and email links to the WildFire global cloud or to one of ...
WildFire Subscription The basic WildFire service is included as part of the Palo Alto Networks next generation firewall and does not require a WildFire subscription. ...
WildFire File Type Support
WildFire File Type Support The following table lists the file types that are supported for analysis in the WildFire cloud environments. File Types Supported for ...
WildFire Submissions Logs
WildFire Submissions Logs The firewall forwards samples (files and emails links) to the WildFire cloud for analysis based on WildFire Analysis profiles settings ( Objects ...
About the WildFire API
About the WildFire API The WildFire™ API extends the malware detection capabilities of WildFire through a RESTful XML-based API. Using the API, you can get ...