The WildFire Virtual Environment identifies previously unknown malware and generates signatures that Palo Alto Networks firewalls can use to then detect and block the malware. When a Palo Alto Networks firewall detects an unknown sample (a file or a link included in an email), the firewall can automatically forward the sample for WildFire analysis. Based on the properties, behaviors, and activities the sample displays when analyzed and executed in the WildFire sandbox, WildFire determines the sample to be benign, grayware, or malicious. WildFire then generates signatures to recognize the newly-discovered malware, and makes the latest signatures globally available every five minutes. All Palo Alto Networks firewalls can then compare incoming samples against these signatures to automatically block the malware first detected by a single firewall.
To learn more about WildFire, or to get started with WildFire now, see the following topics:
Review WildFire Concepts to learn more about the types of samples you can submit for WildFire analysis, WildFire verdicts, and WildFire signatures. Learn more about WildFire Deployments deployments you can set up with the firewall. You can submit samples you would like to have analyzed to a Palo Alto Networks-hosted WildFire cloud, a locally-hosted WildFire private cloud, or you can use a hybrid cloud, where the firewall submits certain samples to the public cloud and certain samples to a private cloud. Get Started with WildFire to define the samples that you want to submit for analysis, and to begin submitted samples to a WildFire cloud.

Related Documentation