WildFire Overview

WildFire provides detection and prevention of zero-day malware using a combination of malware sandboxing
and signature-based detection and blocking of malware. WildFire extends the capabilities of Palo Alto Networks
next-generation firewalls to identify and block targeted and unknown malware.
The following topics describe WildFire and how to integrate into your environment:

About WildFire

WildFire Concepts

WildFire Deployments

WildFire Subscription Requirements

Best Practices for Keeping Signatures up to Date

Reference: Firewall File Forwarding Capacity by Platform

WildFire Administrators Guide

Copyright 2007-2014 Palo Alto Networks

About WildFire

WildFire Overview

About WildFire
Modern malware is at the heart of many of today's most sophisticated network attacks and is increasingly
customized to avoid traditional security solutions. Palo Alto Networks has developed an integrated approach
that addresses the full malware life cycle, which includes preventing infections, identifying zero-day malware
(that is, malware that has not previously been identified by other antivirus vendors) or targeted malware
(malware targeting a specific industry or corporation), as well as pinpointing and disrupting active infections.
The Palo Alto Networks WildFire engine exposes zero-day and targeted malware through direct observation in
a virtual environment within the WildFire system. The WildFire feature also makes extensive use of the Palo
Alto Networks App-ID technology by identifying file transfers within all applications, not just email
attachments or browser-based file downloads.
For information on Palo Alto Networks WildFire privacy policy, refer to
https://live.paloaltonetworks.com/docs/DOC-2880.
Figure: High-Level WildFire Decision Workflow that follows describes the basic WildFire workflow and
Figure: Detailed WildFire Decision Flow provides a more detailed workflow and shows the decision workflow
from the initial file download by a user through the entire workflow to the point where a signature is generated
if the file is determined to be malicious.

WildFire Administrators Guide

Copyright 2007-2014 Palo Alto Networks

WildFire Overview

About WildFire

Figure: High-Level WildFire Decision Workflow

WildFire Administrators Guide

Copyright 2007-2014 Palo Alto Networks

About WildFire

WildFire Overview

Figure: Detailed WildFire Decision Flow

WildFire Administrators Guide

Copyright 2007-2014 Palo Alto Networks

WildFire Overview

WildFire Concepts

WildFire Concepts

File Forwarding

Supported File Types

WildFire Virtual Sandboxes

WildFire Signatures

WildFire Alerts

WildFire Logging and Reporting

Malware Test Samples

File Forwarding
With this integrated solution, you configure the firewall with a file blocking profile and attach it to a security
policy rule that instructs the firewall to automatically forward certain file types to the WildFire system for
analysis. Whenever a file is transferred over a session that matches the security rule, the firewall performs a file
hash check with WildFire to see if the file has been previously analyzed. If the file is new, it is forwarded for
analyses, even if it is contained within a ZIP file or over compressed HTTP. The firewall can also be configured
to forward files inside of decrypted SSL sessions. See Forward Files to a WF-500 WildFire Appliance or Forward
Files to the WildFire Cloud.

Supported File Types

WildFire can analyze the following file types:

APKAndroid Application Package

PEPortable Executable, which includes executable files, object code, DLLs, FON (fonts), and others

PDFPortable Document Format

Microsoft OfficeIncludes document (doc, docx, rtf), workbook (xls, xlsx), and PowerPoint (ppt, pptx)

Java AppletJAR/Class files types

A subscription is not required to analyze PE file types, but is required to analyze all other
supported file types: APK (cloud only; not supported on the WF-500 appliance), PDF, Microsoft
Office, and Java Applet.

WildFire Virtual Sandboxes

WildFire executes the suspect files it receives in a virtual environment and observes the behavior for signs of
malicious activities, such as changes to browser security settings, injection of code into other processes,
modification of files in the Windows system folder, or domains that the sample attempted to access. When the

WildFire Administrators Guide

Copyright 2007-2014 Palo Alto Networks

WildFire Concepts

WildFire Overview

WildFire engine completes the analysis, it generates a detailed forensics report that summarizes the observed
behaviors and assigns a verdict of malware or benign. WildFire includes sandbox support for the following
operating system environments:

Microsoft Windows XP 32-bit

Windows 7 32-bit

WildFire Signatures
The key benefits of the Palo Alto Networks WildFire feature is that it can discover zero-day malware and can
quickly generate signatures to protect against future infections of all of the malware it discovers. For files that
are determined to be malicious, WildFire automatically generates a signature based on the malware payload of
the sample and tests it for accuracy and safety. Because malware evolves rapidly, the signatures that WildFire
generates will address multiple variants of the malware. The new signature is then distributed within 30-60
minutes to all Palo Alto Networks firewalls equipped with a WildFire subscription, or the following day as part
of the antivirus update for firewalls equipped with a Threat Prevention subscription only.
As soon as the firewall is updated with the new signature, any files that contain that malware or a variant of it
will automatically be dropped. Information gathered by WildFire during the analysis of malware is also used to
fortify other Threat Prevention features, such as the PAN-DB malware URL categories, DNS signatures,
antivirus, and anti-spyware signatures. Palo Alto Networks also develops signatures for command and control
traffic, enabling immediate disruption in the communications of any malware inside the network. For details on
signatures and the benefits of having a WildFire subscription, see WildFire Subscription Requirements.

WildFire Alerts
The firewall can provide instant alerts whenever malware is detected on your network by sending email alerts,
syslog, or SNMP traps. This allows you to quickly identify the user who downloaded the malware and eradicate
it before it causes extensive damage or propagates to other users. In addition, every signature generated by
WildFire is automatically propagated to all Palo Alto Networks firewalls protected with a Threat Prevention
and/or WildFire subscription, which provides automatic protection from malware even if it was not found in
your network.

WildFire Logging and Reporting

For each file that WildFire analyzes, a detailed behavioral report is generated within minutes of the file
submission. These reports are available in the WildFire Submissions log on the firewall, from the WildFire
Portal, or though WildFire API queries. The reports show detailed behavioral information about the file,
information on the targeted user, the application that delivered the file, and all URLs involved in the delivery or
phone-home activity of the file. For details on how to access the reports and descriptions of the report fields,
see View WildFire Reports.

WildFire Administrators Guide

Copyright 2007-2014 Palo Alto Networks

WildFire Overview

WildFire Concepts

Malware Test Samples

Palo Alto Networks provides a sample malware file that can be used to test a WildFire configuration on a
PAN-OS firewall. Before downloading the file to test your configuration, make sure that the firewall that is being
tested is configured based on the procedures described in Forward Files to a WF-500 WildFire Appliance or
Forward Files to the WildFire Cloud.
The following lists information about the test file:

Each time the file download link is clicked, a unique file named wildfire-test-pe-file.exe is generated and
downloaded and each file will have a different SHA256 value.

The verdict of the file will always be malicious.

Although a signature is generated for the file, the signature is disabled and will not be distributed.

Download the test file here: http://wildfire.paloaltonetworks.com/publicapi/test/pe.

If you have enabled decryption on the firewall, you can access the encrypted version of the site by replacing
HTTP with HTTPS.

WildFire Administrators Guide

Copyright 2007-2014 Palo Alto Networks

WildFire Concepts

WildFire Overview

After downloading the file, check the Data Filtering log on the firewall to see if the file was forwarded and after
about five minutes, look for the results in the WildFire Submissions log. For more information, see Verify that the
Firewall Can Forward Files to a WildFire Appliance and Verify Firewall File Forwarding to the WildFire Cloud.
To use the API to retrieve the sample test file, see Use the API to Retrieve a Sample Malware Test File.

WildFire Administrators Guide

Copyright 2007-2014 Palo Alto Networks

WildFire Overview

WildFire Deployments

WildFire Deployments
Palo Alto Networks next-generation firewalls support the following WildFire deployments:

Palo Alto Networks WildFire CloudIn this deployment, the firewall forwards files to the hosted
WildFire environment that is owned and maintained by Palo Alto Networks. As WildFire detects new
malware, it generates new signatures within the hour. Firewalls equipped with a WildFire subscription can
receive the new signatures within 30-60 minutes; firewalls with only a Threat Prevention subscription can
receive the new signatures in the next antivirus signature update within 24-48 hours.
The available WildFire cloud servers are wildfire-public-cloud for the WildFire cloud hosted in
the United States and wildfire.paloaltonetworks.jp for the WildFire cloud hosted in Japan.
You may want to use the Japan server if you do not want benign files forwarded to the U.S. cloud servers. If
a file sent to the Japan cloud is determined to be malicious, it will be forwarded to the U.S. servers where the
file will be analyzed again and signatures will be generated. If you are in the Japan region, you may also
experience faster response time for sample submissions and report generation. Panorama can also be
configured for the Japan cloud. See Forward Files to the WildFire Cloud for more details.

WildFire ApplianceIn this deployment, you install a WF-500 WildFire appliance on your corporate
network and configure your firewalls to forward files to it instead of to the Palo Alto Networks WildFire
cloud (the default). This deployment prevents the firewall from having to send any files outside of your
network for analysis. By default, the appliance will not send any files out of your network unless you explicitly
enable the auto-submit feature, which enables forwarding of any malware it detects to the Palo Alto
Networks WildFire cloud where the files are analyzed to generate antivirus signatures. The antivirus
signatures are then distributed to all Palo Alto Networks firewalls with a threat prevention and/or WildFire
subscription. A single WildFire appliance can receive and analyze files from up to 100 Palo Alto Networks
firewalls.

The main differences between the Palo Alto Networks WildFire cloud and the WildFire appliance are as follows:

The WildFire Appliance enables local sandboxing of malware so that benign files never leave your
network. By default, the WildFire appliance does not forward any files to the WildFire cloud and
therefore signatures are not generated for malware detected by the appliance. If you want WildFire
signatures locally-detected malware, you can enable the auto-submit feature on the appliance to enable
the appliance to send the malware it detects to the WildFire cloud for signature generation.

The WildFire API, which is available with a WildFire subscription, can only be used with the public
cloud, not a private WF-500 appliance.

Manual submission of samples to the public cloud through the WildFire Portal. With the WF-500
appliance, there is no portal, so any logs received from the appliance will contain a link that can be
clicked to manually submit the sample to the public cloud. The sample is then analyzed and a signature
is generated if the sample is found to be malicious. This is useful if auto-submit is not enabled.

Multiple virtual machines run on the WildFire cloud and will represent a variety of operating systems
and applications that are used when running sample files. On the WF-500 appliance, multiple virtual
machines are available, but only one can be chosen for file analysis. When selecting which virtual
machine to use, you can review what is installed and choose the virtual machine that best matches your
environment. For information on viewing and selecting the virtual machine, see Integrate the WF-500
Appliance into the Network.

WildFire Administrators Guide

Copyright 2007-2014 Palo Alto Networks

WildFire Subscription Requirements

WildFire Overview

WildFire Subscription Requirements

WildFire provides detection and prevention of zero-day malware using a combination of malware sandboxing
and signature-based detection and blocking of malware. No subscription is required to use WildFire for
sandboxing files sent from Palo Alto Networks firewalls to the WildFire cloud.
To perform detection and blocking of known malware detected by WildFire requires a Threat Prevention
and/or WildFire subscription. The Threat Prevention subscription enables the firewall to receive daily antivirus
signature updates, which provides coverage for all malware samples detected by WildFire globally to all firewalls
with a Threat Prevention subscription. The Threat Prevention subscription also provides access to weekly
content updates that include new vulnerability protection and anti-spyware signatures.
To receive the full benefits of the WildFire service, each firewall must have a WildFire subscription, which
provides the following benefits:

WildFire Dynamic UpdatesProvide new malware signatures on a sub-hourly basis, configurable

through Device > Dynamic Updates. Within an hour of detecting new malware, WildFire creates a new malware
signature and distributes it through the WildFire dynamic updates, which the firewall can poll every 15, 30,
or 60 minutes. The firewall can be configured to take specific actions on malware signatures separate from
the regular antivirus signature actions in the antivirus profile. The WildFire signatures delivered in the
dynamic update include signatures generated for malware detected in files submitted to WildFire by all Palo
Alto Networks WildFire customers, not just the file samples that your firewalls send to WildFire.
It takes approximately 30 to 60 minutes for WildFire to generate a signature and make it available
for subscribers after discovering malware. Firewalls equipped with a WildFire subscription can
poll for new malware signatures every 15, 30, or 60 minutes. If, for example, the firewall is set to
poll for WildFire signature updates every 30 minutes, it may not receive a signature for a file it
uploaded until the second polling interval after the malware was discovered because of the time
required to generate the signature. If the firewall only has a Threat Prevention subscription, it will
still receive signatures generated by WildFire after they are rolled into the antivirus updates,
which occurs about every 24-48 hours.
For files analyzed by a WF-500 WildFire appliance, signatures can only be generated for malware
detected on your network if you have explicitly enabled the auto-submit feature (unless the same
malware was observed by another customer and submitted the same sample to the WildFire
public cloud). When auto-submit is enabled, the appliance will forward all discovered malware to
the Palo Alto Networks WildFire cloud where they will be used to generate an antivirus signature
to detect and block future instances of the malware.

WildFire Advanced File Type SupportIn addition to PE files, a subscription allows the firewall to also
forward the following advanced file types: APK (WildFire cloud only), PDF, Microsoft Office, and Java
Applet.

WildFire APIThe WildFire subscription provides access to the WildFire API, which enables direct
programmatic access to the WildFire service on the Palo Alto Networks WildFire cloud. You can use the
WildFire API to submit files to the WildFire cloud and to retrieve reports for the submitted files. The
WildFire API supports up to 100 file submissions per day and up to 1000 queries per day. Note that you
cannot use the WildFire API to submit files to the WildFire appliance.

WildFire ApplianceOnly firewalls with a valid WildFire subscription can forward files to a WildFire
appliance for analysis. Firewalls that only have a Threat Prevention subscription installed can forward files
to the WildFire cloud, but not to a WildFire appliance.

10

WildFire Administrators Guide

Copyright 2007-2014 Palo Alto Networks

WildFire Overview

Best Practices for Keeping Signatures up to Date

Best Practices for Keeping Signatures up to Date

This section describes the best practices for keeping a firewall with a Threat Prevention and WildFire up-to-date
with the latest protection. For a streamlined workflow, use Panorama to push dynamic update schedules to
managed firewalls using Panorama templates. This ensures consistency across all firewalls and simplifies
management of update schedules.
These guidelines provide two schedule options: the minimum recommended schedule and a more aggressive
schedule. Choosing the more aggressive approach causes the device to perform updates much more frequently,
some of which can be very large (over 100MB for antivirus updates). Also, in rare instances, there could be
errors in signature updates. Therefore, consider delaying new update installations until they have been released
for a certain number of hours. Use the Threshold (Hours) field to specify how long after a release to wait before
performing a content update.

AntivirusNew antivirus content updates are released on a daily basis. To get the latest content, schedule
these updates daily at minimum. For a more aggressive schedule, schedule them hourly.

Applications and ThreatsNew App-ID, vulnerability protection, and anti-spyware signatures are
released as weekly content updates (normally on Tuesdays). To receive the latest content, schedule the
updates at least weekly. For a more aggressive schedule to ensure that the firewall receives the latest
content soon after they are released (including occasional off-schedule emergency content releases),
schedule them daily.

WildFireNew WildFire antivirus signatures are published every 30 minutes. Depending on when new
malware is discovered within the release cycle, coverage is provided in the form of a WildFire signature
30-60 minutes after it is first discovered by WildFire. To get the latest WildFire signatures, schedule these
updates every hour or half-hour. For a more aggressive schedule, you may want to schedule the firewall to
check for updates as often as every 15 minutes.
When configuring a WildFire signature update schedule, the number of minutes past the hour can
not be set to zero or the updates will fail. For example, if you set the recurrence to 15 minutes,
the valid values for minutes past the hour is 1-14. For a recurrence of 30 minutes the valid range
is 1-29 and for every hour the valid range is 1-59 minutes.

WildFire Administrators Guide

11

Copyright 2007-2014 Palo Alto Networks

Reference: Firewall File Forwarding Capacity by Platform

WildFire Overview

Reference: Firewall File Forwarding Capacity by Platform

This section describes the maximum rate per minute at which each Palo Alto Network firewall platform can
submit files to the WildFire cloud or a WF-500 appliance for analyses. If the per-minute limit is reached, files
are queued.
The Reserved Drive Space column in the following table lists the amount of drive space on the firewall that is
reserved for queuing files that are waiting to be forwarded to WildFire. If the limit is reached, forwarding of new
files will be canceled until more space in the queue is available.
The speed at which the firewall can forward files to WildFire also depend on the bandwidth of the
upload link to the WildFire systems.

Platform

Maximum Files Per-Minute

Reserved Drive Space

VM-100

100MB

VM-200

10

200MB

VM-300

20

200MB

PA-200

100MB

PA-500

10

200MB

PA-2000 Series

20

200MB

PA-3020

50

200MB

PA-3050

50

500MB

PA-4020

20

200MB

PA-4050/4060

50

500MB

PA-5020/5050

50

500MB

PA-5060

100

500MB

PA-7050

100

1GB

12

WildFire Administrators Guide

Copyright 2007-2014 Palo Alto Networks