WildFire Inline ML

To take advantage of WildFire inline ML, you must have an active WildFire subscription to analyze Windows executables.
Verify that you have a WildFire subscription. To verify subscriptions for which you have currently-active licenses, select
Device
Licenses
and verify that the appropriate licenses display and are not expired.

Create a new or update your existing Antivirus Security profiles to use the real-time WildFire analysis classification engine.
Select an existing
Antivirus Profile
or
Add
a new one (
Objects > Security Profiles > Antivirus
).
Configure your Antivirus profile.
Select
WildFire Inline ML
and apply an
Action Setting
for each WildFire inline ML model. This enforces WildFire inline ML Actions settings for each protocol on a per-model basis. There are three classification engines: Windows Executables, PowerShell Scripts 1, and PowerShell Scripts 2.

enable (inherit per-protocol actions)
—WildFire inspects traffic according to your selections in the WildFire Inline ML Action column in the decoders section of the
Action
tab.
alert-only (override more strict actions to alert)
—WildFire inspects traffic according to your selections in the WildFire Inline ML Action column in the decoders section of the
Action
tab and overrides any action with a severity level higher than
alert
(
drop
,
reset-client
,
reset-server
,
reset-both
)
alert
, which allows traffic to pass while still generating and saving an alert in the threat logs.
disable (for all protocols)
—WildFire allows traffic to pass without any policy action.
Click
OK
to exit the Antivirus Profile configuration dialog and
Commit
your new settings.
(
Optional
) Add file exceptions to your Antivirus Security profile if you encounter false-positives. You can add the file exception details directly to the exception list or by specifying a file from the threat logs.
Add file exceptions directly to the exceptions list.
Select
Objects > Security Profiles > Antivirus
.
Select an Antivirus profile for which you want to exclude specific files and then select
WildFire Inline ML
.
Add the hash, filename, and description of the file that you want to exclude from enforcement.

Click
OK
to save the Antivirus profile and then
Commit
your changes.
Add file exceptions from threat logs entries.
Select
Monitor > Logs > Threat
and filter the logs for the
ml-virus
threat type. Select a threat log for a file for which you wish to create a file exception.
Go to the
Detailed Log View
and scroll to
Details
and then
Create Exception
.
Add a
Description
and click
OK
to add the file exception.
You can find the new file exception in the
File Exceptions
list (
Objects
Security Profiles
Antivirus
WildFire Inline ML
.
(Optional)
See Configure WildFire Inline ML for information about testing your firewall’s connection to the inline ML cloud service and viewing related logs.