Configure a WildFire Analysis Profile (PAN-OS & Panorama)

1. Go to ObjectsSecurity ProfilesWildFire Analysis.
2. Add a profile.
3. Give your profile a Name that tells other administrators what it does.
4. Give a Description of the purpose of this profile for easy reference and reuse later.
5. Select OK to save your configuration.
6. Once you've saved your initial configuration, consider carrying out these tasks:
   • Forward Files for Advanced WildFire Analysis
     Forward unknown files or email links and blocked files that match existing antivirus signatures for analysis. Use the WildFire Analysis profile to define files to forward to one of the Advanced WildFire public cloud options and then attach the profile to a security rule to trigger inspection for zero-day malware.
   • Forward Decrypted SSL Traffic for Advanced WildFire Analysis
     Traffic that the firewall decrypts is evaluated against Security rules; if it matches the WildFire Analysis profile attached to the security rule, the decrypted traffic is forwarded for analysis before the firewall re-encrypts it.
   • Enable Advanced WildFire Inline ML
     Prevent malicious variants of Portable Executables and PowerShell scripts from entering your network in real-time using machine learning (ML) based analytics on the firewall dataplane. By utilizing WildFire® Cloud analysis technology on your security platform, Advanced WildFire Inline ML dynamically detects malicious files of a specific type by evaluating various file details, including decoder fields and patterns, to formulate a high probability classification of a file.
   • Enable Advanced WildFire Inline Cloud Analysis
     Palo Alto Networks Advanced WildFire operates a series of cloud-based ML detection engines that provide inline analysis of PE (Portable Executable) files traversing your network to detect and prevent advanced malware in real-time.
   • Enable Hold Mode for Real-Time Signature Lookup
     Configure the NGFW to hold the transfer of a sample while the real-time signature cloud performs a signature lookup.
   • Verify WildFire Submissions
     Test your deployment using malware test samples, and also verify that the firewall is correctly forwarding files for WildFire analysis.
   • Manually Upload Files to the WildFire Portal
     All Palo Alto Networks customers with a support account can use the Palo Alto Networks WildFire portal to manually submit up to five samples a day for analysis.
   • Firewall File Forwarding Capacity by Model