Enable Free WildFire Forwarding
WildFire is a cloud-based virtual environment
that analyzes and executes unknown samples (files and email links)
and determines the samples to be malicious, phishing, grayware,
or benign. With WildFire enabled, a Palo Alto Networks firewall
can forward unknown samples to WildFire for analysis. For newly-discovered
malware, WildFire generates a signature to detect the malware and
distributes it to all firewalls with active WildFire subscription
within minutes. This enables all Palo Alto next-generation firewalls
worldwide to detect and prevent malware found by a single firewall.
Malware signatures often match multiple variants of the same malware
family, and as such, block new malware variants that the firewall
has never seen before. The Palo Alto Networks threat research team
uses the threat intelligence gathered from malware variants to block
malicious IP addresses, domains, and URLs.
A basic WildFire
service is included as part of the Palo Alto Networks next-generation
firewall and does not require a WildFire subscription. With the
basic WildFire service, you can enable the firewall to forward portable
executable (PE) files. Additionally, if you do not have a WildFire
subscription, but you do have a Threat Prevention subscription,
you can receive signatures for malware WildFire identifies every
24- 48 hours (as part of the Antivirus updates).
Beyond the
basic WildFire service, a WildFire subscription is required
for the firewall to:
- Get the latest WildFire signatures within a minute of availability—new signatures are released every five minutes.
- Forward advanced file types and email links for analysis.
- Use the WildFire API.
- Use a WildFire appliance to host a WildFire private cloud or a WildFire hybrid cloud.
If you have a WildFire
subscription, go ahead and get started with WildFire to
get the most out of your subscription. Otherwise, take the following steps
to enable basic WildFire forwarding:
- Confirm that your firewall is registered and that
you have a valid support account as well as any subscriptions you
require.
- Log in to the Palo Alto Networks Customer Support Portal(CSP) and on the left-hand side navigation pane, select AssetsDevices.
- Verify that the firewall is listed. If it is not listed, select Register New Device and continue to Register the Firewall.
- (Optional) If you have a Threat Prevention subscription, be sure to Activate Subscription Licenses.
- Log in to the firewall and configure WildFire forwarding settings.
- Select DeviceSetupWildFire and edit the General Settings.
- Set the WildFire Public Cloud field
to forward files to the WildFire global cloud at: wildfire.paloaltonetworks.com.You can also forward files to a regional cloud or a private cloud based on your location and your organizational requirements.
- Review the File Size Limits for
PEs the firewall forwards for WildFire analysis. set the Size
Limit for PEs that the firewall can forward to the maximum
available limit of 10 MB.As a WildFire best practice, set the Size Limit for PEs to the maximum available limit of 10 MB.
- Click OK to save your changes.
- Enable the firewall to forward PEs for analysis.
- Select ObjectsSecurity ProfilesWildFire Analysis and Add a new profile rule.
- Name the new profile rule.
- Add a forwarding rule and enter a Name for it.
- In the File Types column, add pe files to the forwarding rule.
- In the Analysis column, select public-cloud to forward PEs to the WildFire public cloud.
- Click OK.
- Apply the new WildFire Analysis profile to traffic that
the firewall allows.
- Select PoliciesSecurity and either select an existing policy rule or create a new policy rule as described in Set Up a Basic Security Policy.
- Select Actions and in the Profile Settings section, set the Profile Type to Profiles.
- Select the WildFire Analysis profile you just created to apply that profile rule to all traffic this policy rule allows.
- Click OK.
- Enable the firewall to forward decrypted SSL traffic for WildFire analysis.
- Review and implement WildFire best practices to ensure that you are getting the most of WildFire detection and prevention capabilities.
- Commit your configuration updates.
- Verify that the firewall is forwarding PE files to the
WildFire public cloud.Select MonitorLogsWildFire Submissions to view log entries for PEs the firewall successfully submitted for WildFire analysis. The Verdict column displays whether WildFire found the PE to be malicious, grayware, or benign. (WildFire only assigns the phishing verdict to email links). The Action column indicates whether the firewall allowed or blocked the sample. The Severity column indicates how much of a threat a sample poses to an organization using the following values: critical, high, medium, low, information.
- (Threat Prevention subscription only) If you
have a Threat Prevention subscription, but do not have a WildFire
subscription, you can still receive WildFire signature updates every
24- 48 hours.
- Select DeviceDynamic Updates.
- Check that the firewall is scheduled to download, and install Antivirus updates.
Related Documentation
Get Started with WildFire
Get Started with WildFire The following steps provide a quick workflow to get started with WildFire™. If you’d like to learn more about WildFire before ...
WildFire Subscription
WildFire Subscription The basic WildFire service is included as part of the Palo Alto Networks next generation firewall and does not require a WildFire subscription. ...
Forward Files for WildFire Analysis
Forward Files for WildFire Analysis Configure Palo Alto Networks firewalls to forward unknown files or email links and blocked files that match existing antivirus signatures ...
WildFire Signatures
WildFire Signatures WildFire can discover zero-day malware in web traffic (HTTP/HTTPS), email protocols (SMTP, IMAP, and POP), and FTP traffic and can quickly generate signatures ...
Review WildFire Logs
Review WildFire Logs In addition to the Threat logs, use the victim IP address to filter though the WildFire Submissions logs. The WildFire Submissions logs ...
About the WildFire Appliance
About the WildFire Appliance The WildFire appliance provides an on-premises WildFire private cloud, enabling you to analyze suspicious files in a sandbox environment without requiring ...
WildFire Example
WildFire Example The following example scenario summarizes the full WildFire™ lifecycle. In this example, a sales representative from Palo Alto Networks downloads a new software ...
Verify WildFire Submissions
Verify WildFire Submissions Test your WildFire setup using malware test samples, and also verify that the firewall is correctly forwarding files for WildFire analysis. Test ...