Automated Prevention
Once a file is determined to be malicious, WildFire automatically
develops protections for the new threat and generates integrated
and correlated logs for security staff.Within minutes of submitting
a file to WildFire, subscribers receive an integrated log with the
verdict of the malware analysis, which is correlated with any
other relevant logs in the Palo Alto Networks user interface.
Additionally, all WildFire users can receive notifications via
email based on policy.
The WildFire public cloud also develops a range of protections
for all newly discovered malware (customers using a private cloud
deployment have the option to submit confirmed malware to the
public cloud in order to generate protections). WildFire automatically
develops, tests and delivers new malware signatures
within 30 to 60 minutes to all WildFire subscribers, worldwide.
In addition to malware signatures,WildFire data is used to update
DNS-based signatures, URL categories and command-and-control
signatures as well.
• Malware Signatures: These signatures are based on unique
identifiers in the malware payload that allow a single WildFire
signature to block multiple polymorphic variants. These
signatures are delivered to WildFire subscribers within 30 to
60 minutes of the initial submission of the file.
• DNS Signatures: WildFire records all DNS queries and maintains
a database and signature list of DNS requests that are unique
to botnets and malware operations.
• Command-and-Control Signatures: Palo Alto Networks
researchers maintain full coverage for all command-and-control
traffic observed in WildFire. These signatures provide a key
method for identifying and controlling any malware infections
already in the network.
• URL Categories: WildFire monitors any URLs and domains
that malware communicates with.WildFire then provides updates
on any newly discovered malicious domains to PAN-DB, Palo
Alto Networks internally developed URL filtering database.