This image shows a partial view of the dashboard. Additional widgets
may be available, and dashboard content is subject to change.
The Advanced WildFire Extended Operator Dashboard () is a subscription-specific view that delivers a centralized hub
for malware analysis activity, offering immediate and actionable insights.
Interactive widgets surface critical efficacy metrics—such as inline malware
verdicts, top threats by file type, and infected users—providing an intuitive
starting point for deeper drill-down analysis. By utilizing contextual data on
users, devices, and policies, security teams can detect, investigate, and
remediate malware threats more efficiently than ever before.
Flexible Data Filtering: Customize the dashboard time range (from the
last 15 minutes up to 45 days, or define a custom range) and apply general
filters to isolate specific datasets.
Interactive Widgets: Interact directly with individual widgets to filter
data, reorder columns, zoom, view raw data, export as CSV, and toggle legends
and labels.
Key Visibility Metrics
The Extended Operator Dashboard provides granular visibility into the following
areas:
- Key statistics—High-level metrics tracking total WildFire
submissions, active firewalls forwarding files, and generated WildFire
signatures to easily assess your overall analysis coverage.
- Firewall distribution—Insights into which enforcement points are
generating the highest volume of WildFire submissions.
- User attribution—Malware detections mapped to specific user IP
addresses, enabling rapid identification of targeted or compromised users
("Patient Zero") alongside their associated malware strains.
- Inline prevention—Visibility into threats actively detected and
blocked in real-time by WildFire inline cloud analysis, compared against
malicious files currently allowed by policy.
- Threat breakdown—Categorization of top WildFire threats by name
and malicious file types (such as MS Office documents, PDFs, portable
executables, Flash files, and email links).
Operational Use Cases
Leverage the dashboard data to drive the following investigative and operational
initiatives:
- Halt zero-day malware—Verify that novel, zero-day malware variants
are blocked in real-time prior to execution. By proactively preventing
threats before they generate downstream alerts, teams can significantly
reduce SOC alert fatigue and manual triage efforts.
- Assess impact radius and identify Patient Zero—Quickly pinpoint the
most heavily infected hosts and users to prioritize your incident response
workflow. Cross-reference this data with specific file types (such as
malicious macros, PDF exploits) to fully understand the attack vector and
payload capabilities.
- Identify policy gaps—Review malware currently permitted by your
existing policies alongside threats prevented inline. This highlights
critical opportunities to refine WildFire forwarding profiles and security
policies, ultimately enforcing inline prevention and strengthening your
overall security posture.
