OOXML Support for WildFire Inline ML

1. Update your existing Antivirus Security profile to enable the OOXML real-time WildFire analysis classification engine.
   1. Select an existing Antivirus Profile or Add a new one (Objects > Security Profiles > Antivirus).
   2. Configure your Antivirus profile.
   3. Select WildFire Inline ML and apply an Action Setting for the new WildFire inline ML model. This enforces WildFire inline ML Actions settings for each protocol on a per-model basis. In addition to the currently available classification engines, OOXML should now be available. If this model is unavailable, verify that you have content release 8825 or later installed on the firewall.
      • enable (inherit per-protocol actions)—WildFire inspects traffic according to your selections in the WildFire Inline ML Action column in the decoders section of the Action tab.
      • alert-only (override more strict actions to alert)—WildFire inspects traffic according to your selections in the WildFire Inline ML Action column in the decoders section of the Action tab and overrides any action with a severity level higher than alert (drop, reset-client, reset-server, reset-both) alert, which allows traffic to pass while still generating and saving an alert in the threat logs.
      • disable (for all protocols)—WildFire allows traffic to pass without any policy action.
   4. Click OK to exit the Antivirus Profile configuration dialog and Commit your new settings.
2. (Optional) Add file exceptions to your Antivirus Security profile if you encounter false-positives. This is typically done for users who are not forwarding files to WildFire for analysis. You can add the file exception details directly to the exception list or by specifying a file from the threat logs.
   If your firewall WildFire Analysis security profile is configured to forward MS Office files (which also includes OOXML for standard WildFire analysis), false-positives are automatically corrected as they are received. If you continue to see ml-virus alerts for files that have been classified as benign by WildFire Analysis, please contact Palo Alto Networks Support.
   • Add file exceptions directly to the exceptions list.
     1. Select Objects > Security Profiles > Antivirus.
     2. Select an Antivirus profile for which you want to exclude specific files and then select WildFire Inline ML.
     3. Add the hash, filename, and description of the file that you want to exclude from enforcement.
     4. Click OK to save the Antivirus profile and then Commit your changes.
   • Add file exceptions from threat logs entries.
     1. Select Monitor > Logs > Threat and filter the logs for the ml-virus threat type. Select a threat log for a file for which you wish to create a file exception.
     2. Go to the Detailed Log View and scroll to Details and then Create Exception.
     3. Add a Description and click OK to add the file exception.
     4. You can find the new file exception in the File Exceptions list (ObjectsSecurity ProfilesAntivirusWildFire Inline ML.
3. (Optional) See Configure WildFire Inline ML for information about testing your firewall’s connection to the inline ML cloud service and viewing related logs.