WildFire® is Palo Alto Networks' cloud-based malware analysis service designed to detect and prevent unknown, zero-day threats. Traditional signature-based security relies on previously identified patterns, but advanced threats often use new or polymorphic techniques to evade detection. WildFire addresses this by analyzing unknown files and links in a secure sandbox environment.
When the firewall encounters a file or web link it doesn't recognize (i.e., no existing signature or known verdict), it can be configured to forward a sample to the WildFire cloud (or a private WildFire appliance) for analysis. Based on the analysis, WildFire returns a verdict ( Benign, Grayware, Malware, Phishing ). If malicious, WildFire automatically generates new protections (signatures) that are distributed globally via content updates, protecting all subscribed customers.
WildFire Analysis Profiles are the configuration objects used on the firewall to define *which* unknown files and links should be submitted for analysis.
graph TD
A[User Downloads Unknown File Link] --> B(Firewall Security Policy Match, Action=Allow);
B --> C{Apply WildFire Analysis Profile};
C -- Matches Criteria? --> D{Forward Sample};
D --> E[WildFire Cloud - Private Appliance Analysis];
E -- Verdict --> B;
B --> F[Log Submission & Verdict];
E -- If Malicious --> G(Generate Signatures);
G --> H(Distribute via Content Updates);
H --> AllFWs[Other Subscribed Firewalls];
style E fill:#eaf2f8,stroke:#aed6f1,stroke-width:2px
style H fill:#fdebd0,stroke:#f5b041,stroke-width:1px
Simplified WildFire Submission and Protection Flow.
Objects > Security Profiles > WildFire Analysis
Add
to create a new profile.
| Parameter (Analysis Tab) | Description | Best Practice Recommendation |
|---|---|---|
| Name | Descriptive name (e.g., `WildFire-Forward-Executables-Office`). | Required |
| Applications | Specify applications for which files/links should be forwarded. Can be `any` or a selection. | `any` - Ensures files transferred via any application are analyzed, maximizing visibility. |
| File Types | Select specific file types to forward (e.g., PE, PDF, Office, APK, Scripts) or `any`. | Select common threat vectors (PE, PDF, MS Office, Scripts, APK, Flash, Java Archives, etc.). Avoid `any` unless you have specific needs and understand the volume/privacy implications, as it can forward benign file types unnecessarily. |
| Direction | Choose `upload`, `download`, or `both`. | `both` - Threats can enter via downloads and data can be exfiltrated via uploads. |
| Maximum File Size | Defines the max size (MB) for submitted files (cloud limits vary but generally up to 100MB or more for PE, lower for others). | Leave defaults unless specific reason to change; ensure it's within cloud/appliance limits. |
| Report Benign Files / Report Grayware Files | Forward files even if previously determined benign/grayware by WildFire (e.g., for re-analysis or logging). | Usually leave unchecked unless needed for specific forensic or analysis purposes (can increase submission volume). |
A WildFire Analysis Profile only takes effect when applied to Security Policy rules.
Policies > Security
Typically, apply WildFire Analysis profiles to rules allowing traffic ingress from untrusted zones (like the internet) and potentially egress to untrusted zones to catch both malicious downloads and uploads/exfiltration attempts.
Monitor > Logs > WildFire Submissions
) to verify files are being submitted and verdicts received.
| Feature | With WildFire License | Without WildFire License |
|---|---|---|
| Signature Update Frequency | Real-time updates as soon as signatures are generated | Every 24–48 hours via standard antivirus updates |
| File Analysis Capabilities | Supports advanced file types including PE, APK, PDF, Office documents, and scripts | Limited to basic PE file analysis |
| Inline Machine Learning (ML) | Enabled for real-time detection of unknown threats | Not available |
| API Access | Full access to submit files and retrieve analysis reports | Not available |
| Hold Mode for Real-Time Signature Lookup | Available to delay file delivery until signature verdict is received | Not available |
For more detailed information, refer to the official Palo Alto Networks documentation on Advanced WildFire Subscription .
For the PCNSE exam, regarding WildFire Submissions:
Objects > Security Profiles > WildFire Analysis
.
1. What is the primary purpose of the WildFire service?
2. Which PAN-OS object defines the criteria (e.g., file types, applications, direction) for submitting samples to WildFire?
3. How is a WildFire Analysis Profile applied to inspect traffic?
4. What is required for WildFire to analyze a malicious file downloaded by a user over an HTTPS connection?
5. Which setting in the WildFire Analysis profile is generally recommended for the 'Applications' criteria to maximize visibility?
6. What is the primary difference between using the Public WildFire Cloud versus a Private WildFire Appliance?
7. After WildFire analyzes a file and determines it is malware, how does the firewall typically receive protection against future encounters with that file?
8. Which log type on the PAN-OS firewall specifically tracks files submitted to WildFire and the verdicts received?
9. What is required on the firewall to use the WildFire analysis service?
10. What is a primary reason why configuring 'File Types' to `any` in a WildFire Analysis profile is generally NOT recommended?