Palo Alto WildFire

Palo Alto WildFire is a threat prevention and malware analysis engine included in Palo Alto firewalls.

https://docs.paloaltonetworks.com/wildfire/u-v/wildfire-whats-new/wildfire-features-in-panos-90.html

Sandbox-based (WildFire) approach

• Wildfire: show wildfire [cloud-info, disk-usage, status, statistics, telemetry-statistics]

• License: show wildfire status

Wildfire options:

• WildFire Global Cloud
• WildFire U.S. Government cloud
• WildFire Private Cloud
• WildFire Hybrid Cloud

On Monitor -> Logs -> Wildfire submissions it is possible to visualize Wildfire submissions and veredict.

• File types: pe, apk, pdf, ms-office, jar, flash, MacOSX, archive, linux, script. Since PAN-OS 10.0 Windows executables and PowerShell scripts inline on dataplane.

Related terms

• Benign, grayware, phishing, or malicious
• WildFire cloud
• PAN-DB URL Filtering license

2020/11/26 08:00:32 info     general        general 0  Installed WildFire package: panupv2-all-wildfire-YYYY-XXXXX.tgz

Activities

• Visualize Wildfire submission and veredicts: On Monitor -> Logs -> Wildfire submissions

See also

• Link: https://wildfire.paloaltonetworks.com
• Wildfire: show wildfire [cloud-info, disk-usage, status, statistics, telemetry-statistics]
• IDS, HIDS: snort, fail2ban, RdpGuard, suricata, OSSEC, Wazuh, Palo Alto WildFire, Malware analysis, SIEM, Samhain
• PAN-OS (Palo Alto): PAN-OS Releases, show vpn, GlobalProtect, GlobalProtect logs, WildFire, show log, show session all, MDM, match, PAN-OS reports, HIP, Zone