Hold Mode for WildFire Real-Time Signature Lookup
Table of Contents
Hold Mode for WildFire Real-Time Signature Lookup
Hold mode enables you to hold file a sample transfer while the NGFW queries the real-time signature cloud to perform a signature lookup.
PAN-OS 11.0.2 now supports the option to hold file a sample transfer while the NGFW queries the real-time signature cloud to perform a signature lookup. When the lookup is completed, the file is released to the requesting client, based on your organization's security policy for specific WildFire verdicts - this prevents the initial transfer of known malware; in other words, reduces the likelihood of a patient zero outbreak from occurring. You can configure the hold mode on a per antivirus profile basis and apply a global setting for the signature lookup timeout and the associated action. This feature is available to all users with an active WildFire or Advanced WildFire subscription.
- To enable hold mode for WildFire real-time signature lookups, you must have either a WildFire or Advanced WildFire subscription service license. Make sure to activate the license on the NGFW if you have not done so already. To verify subscriptions for which you have currently-active licenses, select and verify that the appropriate licenses display and are not expired. The example below shows the description for the standard WildFire license.
- Configure the timeout setting and action when the request exceeds the timeout.You must enable hold mode for WildFire real-time signature lookups globally before you enable hold mode on a per-Antivirus profile basis.
- Select
- EnableHold for WildFire Real Time Signature Look Up.
- Specify theWildFire Real Time Signature Lookup Timeout (ms)in milliseconds (the default value is 1000).Palo Alto Networks recommends using the default value of 1000ms unless you experience repeated timeouts during testing.
- Specify theAction On Real Time WildFire Signature Timeout. The default value isAllow, however, Palo Alto Networks recommends setting this toReset-Bothwhen hold mode is enabled. The options include the following:
- Allow—The NGFW allows packets through when the hold timeout threshold is reached.
- Reset Both—The NGFW resets the connection on both the client and server ends when the hold timeout threshold is reached.
- SelectOKwhen finished.
- Update or create a new Antivirus Security profile to enable hold mode for WildFire real-time signature lookups.
- Select an existing antivirus security profile orAdda new one ().
- Select your antivirus security profile and then go toAction.
- SelectHold for WildFire Real Time Signature Look Up.
- Repeat steps 4a-4c for all active antivirus profiles for which you want to enable hold mode for WildFire real-time signature lookups.
- Commityour changes.
- (Optional) You can view a summary of your antivirus security profile settings, including hold mode enablement, on the antivirus summary view page.
