WildFire overview

The WildFire service for Cloud Next Generation Firewall provides advanced malware sandboxing and dynamic machine learning (ML) to protect your network against unknown, novel, and file-based threats.

While a standard signature-based intrusion detection and prevention service can only block threats with recognized signatures, WildFire evaluates suspicious or unknown files in real-time, preventing zero-day malware from reaching your workloads.

WildFire is included as part of the Cloud Next Generation Firewall Enterprise capabilities. For more information, see Pricing.

For information on limits that apply to WildFire resources, see Quotas and limits.

Benefits of using WildFire

Integrating WildFire into Cloud Next Generation Firewall Enterprise provides an upgrade to your network's defensive capabilities. Following are the benefits of using WildFire:

  • Protection against unknown and zero-day threats: Detects and blocks novel or highly customized malware that lacks established signatures.

  • Inline dataplane protection: Intercepts and analyzes file transfers in real-time directly on the zonal firewall dataplane or through rapid cloud lookup to minimizing threat exposure.

  • Adaptive defenses: Automatically generates and updates threat databases with newly discovered threat intelligence.

  • Actionable visibility and forensics: WildFire generates detailed submission logs and threat logs that integrate directly with Cloud Logging. If a threat is detected, you can download detailed analysis reports of the sandbox execution and download the actual malware sample for independent Security Operations Center (SOC) analysis.

How WildFire works

WildFire inspects network-routed file transfers by intercepting packets, performing high-speed local checks, and offloading advanced behavior sandboxing to the cloud when necessary.

The following WildFire architecture diagram shows packet interception from a Virtual Private Cloud (VPC) network virtual machine (VM) to a zonal firewall endpoint, parallel evaluation by the inline ML engine and signature database, real-time cloud lookups, and asynchronous cloud sandboxing.

WildFire architecture and comprehensive step-by-step data flow.
WildFire architecture and comprehensive step-by-step data flow (click to enlarge).

The integration processes and evaluates file transfers through the following stages:

Traffic interception and redirection

When a VM instance inside your VPC network initiates a connection or file transfer, the firewall policy rule redirects the flow as follows:

  1. Packet interception: The Google Cloud Packet Intercept network component captures packets in the traffic stream.
  2. Redirection: The intercept component redirects the network packets to the zonal firewall endpoint for Layer 7 inspection.

Inline local evaluation

After traffic is redirected to the firewall endpoint, the file is analyzed in parallel by two inline, high-performance engines:

  • Signature-based detection: the endpoint compares the file against a local threat signature database. This database is updated in real-time to detect and drop recognized malicious files.

  • Inline ML: the Inline ML engine runs ML models directly in the firewall dataplane. It analyzes the file in real-time to identify zero-day or highly sophisticated threats in supported file types such as Windows_Executable, ELF, Powershell_Script, and MS_Office.

Cloud-based advanced inspection

For zero-day threats or files with unrecognized local signatures, WildFire uses advanced cloud analysis:

  • Inline Cloud analysis: if enabled in the security profile, the firewall temporarily holds the file transfer while performing a real-time lookup in the WildFire Cloud. The cloud evaluates the file and sends a signal back before the file reaches your network.

    The WildFire cloud is a partner Software as a Service (SaaS) platform hosted in Google Cloud and operated by Palo Alto Networks (PAN). It provides deep, asynchronous malware analysis and real-time threat evaluation.

  • Asynchronous Cloud sandbox: if the file verdict is unknown, the firewall extracts the file and uploads it asynchronously to the WildFire Cloud for deep sandboxing. In this isolated container environment, security engines execute the file and audit its behavior.

Action enforcement and logging

Based on the resulting verdict (Malware, Grayware, or Benign), the firewall rule enforces the policy as follows:

  1. Enforce action: the file is either blocked (Deny), recorded (Alert), or permitted (Allow) in accordance with your WildFire analysis security profile.

  2. Audit logs: event logs are recorded in Cloud Logging specifically firewall_wildfire_submission log. These logs are displayed on the WildFire submission dashboard and page.

  3. Sandbox feedback: after asynchronous sandboxing completes, a full behavioral report and the original malware samples are synchronized out-of-band and made available for you to query or retrieve.

Components of WildFire

To use WildFire, you must configure the following components:

Security profiles and security profile groups

  • WildFire analysis security profiles: are generic policy structures of WILDFIRE_ANALYSIS type. They define which file types are submitted for analysis and the direction of traffic. For more information, see WildFire analysis security profile

    For information on WildFire analysis security profile configuration, see Create and manage WildFire analysis security profiles.

  • Security profile groups: act as containers for security profiles. Each group contains one or more security profiles of different types. Note that an intrusion detection and prevention service security profile is mandatory when you include a WildFire analysis security profile in a group.

    For more information, see Create and manage security profile groups.

Firewall endpoint

A firewall endpoint is an organizational resource, created at the zonal level. It inspects Layer 7 traffic in the zone where it is deployed. The endpoints are associated with one or more VPC in the same zone. To filter traffic for a target VM instance, create the firewall endpoint in the same zone as the VPC where the target VM is located.

A firewall endpoint must have the Enable WildFire option selected. This setting applies to the entire endpoint and determines the region where submissions are sent.

For more information, see Firewall endpoint for WildFire.

Firewall policies

Firewall policies apply directly to all ingress and egress traffic of a VM instance. You can use hierarchical firewall policies and global network firewall policies to configure firewall policy rules with Layer 7 inspection.

Firewall policy rules

Firewall policy rules identify the traffic to be inspected and apply the security profile group that contains the WildFire analysis security profile. To configure the WildFire, create a firewall policy rule that does the following:

  • Identifies the type of traffic to be inspected by using multiple Layer 3 and Layer 4 firewall policy rule components.
  • Specifies the security profile group name for the apply_security_profile_group action on the matched traffic.

For the complete WildFire workflow, see Configure the WildFire in your network.

You can also use secure tags in firewall rules to configure WildFire. You can build on existing segmentation that you have set up by using tags in your network to selectively identify VM instance workloads whose file transfers require advanced malware scanning.

If you configure a firewall rule to apply a security profile group and set the destination to 0.0.0.0/0, traffic originating from VMs in zones without an attached firewall endpoint doesn't undergo Layer 7 inspection. The firewall policy rule allows all traffic that matches the other rule parameters, such as source, port, and protocol. To ensure consistent policy enforcement, deploy firewall endpoints in all zones in the VPC network where you have workloads that require Layer 7 inspection.

Supported file types and sizes

The following table lists the file types that are supported for malware analysis.

Category Supported file extensions Maximum size limit
Executables (PE) .dll, .exe, .exe64 16 MB
Executables (Linux) .a, .dex, .elf, .ko, .o, .so 50 MB
Documents (Microsoft Office) .doc, .docx, .xls, .xlsx, .ppt, .pptx, .docm, .dotm, .xlm, .xlsm, .xltm, .pptm, .potm, .ppsm 16 MB
Documents (PDF) .pdf 3 MB
Archives .rar, .zip, .7z, .zbundle 50 MB
Scripts and web (APK) .apk 10 MB
Scripts and web (JAR) .jar 5 MB
Scripts and web (Scripts/Web) .elink, .hta, .pl, .sh 20 KB

WildFire analysis regions

A WildFire region refers to the specific location where Palo Alto Networks hosts the WildFire analysis, which operates entirely outside of Google Cloud. Because of this, these zones don't map to standard Google Cloud regions. Regardless of where your Google Cloud resources are deployed, your WildFire traffic is routed to Palo Alto's designated service zones for analysis.

If you don't specify a WildFire region when configuring your endpoint, the system automatically maps your traffic to the closest available WildFire region. For more information, see Firewall endpoint for WildFire.

The following WildFire regions are supported:

  • US
  • JAPAN
  • SINGAPORE
  • UK
  • CANADA
  • AUSTRALIA
  • GERMANY
  • INDIA
  • SWITZERLAND
  • POLAND
  • INDONESIA
  • TAIWAN
  • FRANCE
  • QATAR
  • SOUTH KOREA
  • ISRAEL
  • SAUDI ARABIA
  • SPAIN

Limitations

When using the reportUri or sampleUri from a WildFire submission log from a project-level endpoint, you must replace the project ID with the project number.

What's next