WildFire analysis profile forwards a narrowed set of file types or one direction
At a glance
Base severity
Area
Platform
Evidence level
Benchmark reference
Reads the export, not the device
ConfigProof reads a configuration export. This control is evaluated against the objects in that file, and it reports what the file says. It does not connect to the device and sees no traffic, so a finding here describes the configuration, not what the firewall is doing right now.
Why it matters
A file type outside the forwarding list is never submitted, so an unknown sample of that type is judged on signatures alone. A rule that forwards in one direction leaves the other direction unsubmitted, which for a profile set on an outbound rule means files arriving are not sent for analysis.
How to fix it
Web interface
The steps below are written for the web interface. A finding raised on your own export carries the same steps with your object names filled in.
- Set the profile's rules to forward file type any, which covers every type the subscription supports.
- Set direction to both, so files are submitted whichever way they cross.
- Where a narrower list is deliberate, keep the executable and archive types in it: those are the ones a signature is least likely to already cover.
Command line
PAN-OS CLI, standalone firewall, vsys1
set vsys vsys1 profiles wildfire-analysis <profile> rules <rule> file-type anyset vsys vsys1 profiles wildfire-analysis <profile> rules <rule> direction bothset vsys vsys1 profiles wildfire-analysis <profile> rules <rule> analysis public-cloud
An example. Values in angle brackets are yours to supply; a finding on your own export fills in the names it read. Nothing here commits. Review the candidate configuration, then commit it yourself.
Read it back
show vsys vsys1 profiles wildfire-analysis <profile>Values to fill in2
- <profile>
- Which profile to change. A firewall carries several of each kind.
- <rule>
- The rule inside the WildFire profile. Rules are ordered and an earlier one may already cover the file types.
Before you type it2
- Rules inside the profile are ordered and the first match wins, so check what an earlier rule already covers.
- Public cloud is shown here. Private cloud needs a WildFire appliance you already run.
How to confirm the fix
- Reopen the profile and confirm the file type and direction on every rule.
- Send a benign test sample and confirm it appears in the WildFire submissions log.
Limits
- A configuration export does not show which WildFire subscription the device holds, and a type outside the subscription is not forwarded whatever the profile says.
- The set of types treated as executable or compressed is a ConfigProof list of PAN-OS file type names. An organization with a narrower list on purpose is making a choice, not a mistake.
- The file types a profile forwards are read across all of its rules together. PAN-OS matches its rules in order, first match wins, so a narrow rule placed first can mean a type counted as forwarded is not reached in practice. This reading can therefore miss a gap; it cannot invent one.
Compliance references
No benchmark recommendation is mapped to this control in this version.
More in Security Profiles
- PAN-SEC-012Outbound internet rule without URL filtering
- PAN-SEC-013Allow rule without WildFire analysis
- PAN-SEC-043Profile group is missing part of the recommended baseline
- PAN-SEC-085URL filtering profile alerts on or allows a high-risk category
- PAN-SEC-087Anti-spyware profile has DNS lists and nothing set to sinkhole
- PAN-SEC-088Anti-spyware profile sinkholes DNS queries to no address
- PAN-SEC-099Vulnerability protection profile does not block critical or high severity
- PAN-SEC-100Anti-spyware profile does not block every severity
See it on your own firewall
One complete analysis of one firewall costs nothing. A card is required and nothing is charged.