1. Home
    2. WildFire
    3. WildFire® What's New Guide
    4. Latest WildFire Cloud Features
    5. Script Sample Analysis

    Script Sample Analysis

    To use this feature, be sure to download and install the latest PAN-OS content release. PAN-OS Applications and Threats content release 8101 enables you to specify file forwarding of script files. For more information about the update, refer to the Applications and Threat Content Release Notes.
    To download the release notes, log in to the Palo Alto Networks Support Portal, click
    Dynamic Updates
     and select the release notes listed under
    Apps + Threats.
    The WildFire public cloud can now analyze and classify script files with verdicts using static and dynamic analysis. When a malicious script is discovered, the WildFire cloud generates and distributes C2 and DNS signatures to firewalls to prevent successful script-based attacks. Because C2 and DNS signatures look at key network behaviors contained within samples, these signatures can detect activity in previously unknown malicious scripts. To ensure that you are protected from the latest threats, always keep your firewalls up-to-date with the latest content and software updates from Palo Alto Networks.
    • The WildFire appliance does not support script file analysis at this time.
    • Only firewalls operating PAN-OS 8.1 and later can forward scripts to the WildFire public cloud.
    The WildFire cloud is capable of analyzing the following script types:
    • JScript (.js)
    • VBScript (.vbs)
    • PowerShell Script (.ps1)
    To forward script files for analysis, the
    WildFire Analysis Profile
     on the firewall must be configured to forward the
    script
     file type or
    Any
     unknown files to the WildFire public cloud.
    1. Enable file type forwarding.
      1. Select
        Objects > Security Profiles > WildFire Analysis
         and
        Add
         or modify a profile to define traffic to forward for WildFire analysis.
      2. Add or modify a profile rule, select
        file type
        , and set the rule to forward the new
        Any
         file type. You can also specify the
        script
         file type if you want to forward only scripts.
        Profile rules with the file type set to
        Any
         forward all file types for WildFire analysis.
      3. Select Destination and set the profile rule to forward the files to the
        public-cloud
        .
      4. Click
        OK
         to save the new or modified WildFire Analysis profile.
    2. Attach the WildFire Analysis profile to a security policy rule—traffic matched to the policy rule is forwarded for WildFire Analysis.
      1. Select
        Policies > Security
         and
        Add
         or modify a security policy rule.
      2. Select
        Actions
         and set the
        Profile Type
         to
        Profiles
        .
      3. Select the newly-created
        WildFire Analysis
         profile.
      4. Click
        OK
         to save the security policy rule.
        For detailed steps to configure a WildFire Analysis profile and to attach the profile to a security policy rule, see Forward Files for WildFire Analysis.
    3. Select
      Monitor > WildFire Submissions
       to find WildFire verdicts and analysis reports for script files that have been submitted by the firewall.
    You can also submit script files directly to the WildFire public cloud for analysis. With a WildFire subscription, you can manually and programmatically submit a daily total of 1,000 files. Each submission counts as a single upload regardless of the content.
    1. Manually submit files to the WildFire public cloud for analysis. You can then view the WildFire sample analysis report and verdict (malicious, grayware or benign) on the WildFire portal.
    2. Use the WildFire API to submit files to the WildFire public cloud. You can use the WildFire API to retrieve verdicts and analysis reports for the files. You can also specify script as the target analysis environment when you retrieve a packet capture through the WildFire API.

    Recommended For You

    Recommended Videos

    Recommended videos not found.

    © 2023 Palo Alto Networks, Inc. All rights reserved.

    Techdocs Logo