Create and manage WildFire analysis security profiles

This page explains how to create and manage security profiles of the WILDFIRE_ANALYSIS type by using the Google Cloud console and the Google Cloud CLI.

To check the progress of the operations listed on this page, make sure that you have the Compute Network User (roles/compute.networkUser) role and the following permissions:

  • networksecurity.operations.get
  • networksecurity.operations.list

Before you begin

Roles

To get the permissions that you need to create, view, update, or delete security profiles, ask your administrator to grant you the necessary Identity and Access Management (IAM) roles on your organization. For more information about granting roles, see Manage access to projects, folders, and organizations.

Create a WildFire analysis security profile

When you create a WildFire analysis security profile (security profile of the type WILDFIRE_ANALYSIS), you can specify the name of the security profile as a string or as a unique URL identifier.

You can construct the unique URL identifier for the security profile in the following formats:

  • Organization-scoped:

    organizations/ORGANIZATION_ID/locations/global/securityProfiles/SECURITY_PROFILE_NAME

  • Project-scoped:

    projects/PROJECT_ID/locations/global/securityProfiles/SECURITY_PROFILE_NAME

When you use a unique URL identifier, it must contain the security profile name, the organization or project, and the location (which is always set to global). Using a unique URL identifier lets you reference the security profile in other resources (such as security profile groups) or run gcloud commands without specifying the organization, project, or location flags separately.

For more information about unique URL identifiers, see Security profile specifications.

Console

  1. In the Google Cloud console, go to the Security profiles page.

    Go to Security profiles

  2. In the project selector menu, select your organization.

  3. Select the Security profiles tab.

  4. Click Create profile.

  5. Enter a name in the Name field.

  6. Optional: Enter a description in the Description field.

  7. To create a Cloud Next Generation Firewall Enterprise security profile, in the Purpose section, select Cloud NGFW Enterprise.

  8. To create a WildFire analysis security profile, in the Type section, select WildFire analysis.

  9. To prevent the transfer of known malware, select the Hold for WildFire real-time signature look up checkbox.

  10. Optional: To set the WildFire overrides, do one or both of the following:

    • In the WildFire signature overrides section, do the following:

      1. Click Add signature by ID.

      2. Enter the signature ID for which you want to override actions.

      3. From the Override action drop-down list, select one of the following:

        • Default: the packet takes the predefined default action specific to that individual threat signature.
        • Allow: the packet matching the firewall policy rule allows the connection.
        • Deny: the packet and all subsequent packets belonging to the same connection drop completely. The firewall rule will also generate a threat_log entry.

      4. Click Add signature.

    • In the WildFire protocol overrides section, do the following:

      1. Click  Edit for Protocol that you want to override. For example, HTTP, SMTP, or FTP.
      2. From the WildFire action drop-down list, select the action. For example, Alert, Allow, or Deny.
      3. From the WildFire inline ML action drop-down list, select the action. For example, Alert, Allow, or Deny.
      4. Click Confirm.

  11. Optional: In the WildFire submission rules section, do the following:

    1. Click Create rule.
    2. For File types, select Any or Specific.

    3. For Direction, do one of the following:

      • Upload and download: the firewall will monitor traffic in both the upload and download directions for submission rules.
      • Upload: the firewall will only monitor outgoing traffic (uploads) for files to submit.
      • Download: the firewall will only monitor incoming traffic (downloads) for files to submit.

    4. Click Create.

  12. Optional: In the WildFire inline cloud analysis rules section, do the following:

    1. Click Create rule.
    2. For File types, select Any or PE.

    3. For Direction, do one of the following:

      • Upload and download: the firewall will monitor traffic in both the upload and download directions for inline cloud analysis.
      • Download: the firewall will only monitor incoming traffic (downloads) for inline cloud analysis.

    4. From Action drop-down list, select one of the following:

      • Alert: the packet is allowed to communicate, but the firewall rule generates a threat_log entry sent to the consumer project.
      • Allow: the packet matching the firewall policy rule allows the connection.
      • Deny: the packet and all subsequent packets belonging to the same connection drop completely. The firewall rule will also generate a threat_log entry.

    5. Click Create.

  13. Optional: In the WildFire inline ML configuration section, do the following:

    1. Click  Edit for the File type that you want to configure. For example, ELF, Shell, or Macho.
    2. From the Action drop-down list, select the action. For example, Alert or Enable.
    3. Click Confirm.

  14. Optional: In the WildFire inline ML file exceptions section, do the following:

    1. Click Add exception.
    2. Enter the filename for which you want to exclude the WildFire inline machine learning (ML) analysis.
    3. Enter the machine learning partial hash name for which you want to exclude the WildFire inline ML analysis.
    4. Click Create.

  15. Click Create.

gcloud

  1. To create the WildFire analysis security profile, run the gcloud beta network-security security-profiles wildfire-analysis create command:

    gcloud beta network-security security-profiles wildfire-analysis create NAME \
    --location=LOCATION \
    --organization=ORGANIZATION_ID \
    --project=PROJECT_ID \
    --description=DESCRIPTION

    Replace the following:

    • NAME: the name of the WildFire analysis security profile; you can specify the name as a string or as a unique URL identifier.

      If you use a unique URL identifier for the NAME flag, you can omit the LOCATION and ORGANIZATION flags.

    • LOCATION: the location of the WildFire analysis security profile.

      Location is always set to global. If you use a unique URL identifier for the NAME flag, you can omit the LOCATION flag.

    • ORGANIZATION_ID: the organization where the WildFire analysis security profile is created. If you use a unique URL identifier for the name flag, you can omit the ORGANIZATION_ID flag.

    • PROJECT_ID: the project ID of the WildFire analysis security profile.

    • DESCRIPTION: an optional description for the WildFire analysis security profile.

  2. Optional: To add and manage signature overrides, you can use one or more of the following options:

    gcloud beta network-security security-profiles wildfire-analysis add-override NAME \
    --location=global \
    --organization=ORGANIZATION_ID \
    --project=BILLING_PROJECT_ID \
    --wildfire=HTTP,SMTP \
    --action=DENY

    gcloud beta network-security security-profiles wildfire-analysis add-override NAME \
    --location=global \
    --organization=ORGANIZATION_ID \
    --project=BILLING_PROJECT_ID \
    --wildfire-inline-ml=HTTP \
    --action=DENY

    gcloud beta network-security security-profiles wildfire-analysis add-override NAME \
    --location=global \
    --organization=ORGANIZATION_ID \
    --project=BILLING_PROJECT_ID \
    --threat-ids=599805 \
    --action=ALLOW

    Replace the following parameters based on your selection:

    • NAME: the name of the WildFire analysis security profile.
    • ORGANIZATION_ID: the organization ID.
    • BILLING_PROJECT_ID: the project ID used for billing and quotas.
    • --wildfire: the protocol(s) to override action for. Must be one of: SMTP, SMB, POP3, IMAP, HTTP2, HTTP, FTP.
    • --wildfire-inline-ml: local inline ML threats protocol override option.
    • --threat-ids: threat signature IDs to override. Note that action must be Default or Allow.
    • ACTION: action to apply. Must be one of: Default, Allow, Deny or Alert.

  3. Optional: To configure WildFire submission rules, run the gcloud beta network-security security-profiles wildfire-analysis add-submission-rule command:

    gcloud beta network-security security-profiles wildfire-analysis add-submission-rule NAME \
    --location=LOCATION \
    --organization=ORGANIZATION_ID \
    --project=BILLING_PROJECT_ID \
    --file-types=FILE_TYPE1,FILE_TYPE2,... \
    --direction=DIRECTION

    Replace the following:

    • NAME: the name of the WildFire analysis security profile.

    • LOCATION: the location of the WildFire analysis security profile.

      Location is always set to global. If you use a unique URL identifier for the NAME flag, you can omit the LOCATION flag.

    • ORGANIZATION_ID: the organization where the WildFire analysis security profile is created. If you use a unique URL identifier for the name flag, you can omit the ORGANIZATION_ID flag.

    • BILLING_PROJECT_ID: the project ID to use for billing and quotas.

    • FILE_TYPE1,FILE_TYPE2: types of files that will be submitted to WildFire for analysis. File type must be one of: ANY_FILE, APK, ARCHIVE, EMAIL_LINK, FLASH, JAR, LINUX, MS_OFFICE, PDF, PE, SCRIPT. Note that if ANY_FILE is specified, no other types should be specified.

    • DIRECTION: direction of traffic that will be checked for files to submit to WildFire. Direction must be one of: Upload, Download, Both.

  4. Optional: To configure WildFire inline cloud analysis rules, run the gcloud beta network-security security-profiles wildfire-analysis add-inline-cloud-analysis-rule command:

    gcloud beta network-security security-profiles wildfire-analysis add-inline-cloud-analysis-rule NAME \
    --location=LOCATION \
    --organization=ORGANIZATION_ID \
    --project=BILLING_PROJECT_ID \
    --file-types=FILE_TYPE1,FILE_TYPE2,... \
    --direction=DIRECTION \
    --action=ACTION

    Replace the following:

    • NAME: the name of the WildFire analysis security profile.

    • LOCATION: the location of the WildFire analysis security profile.

      Location is always set to global. If you use a unique URL identifier for the NAME flag, you can omit the LOCATION flag.

    • ORGANIZATION_ID: the organization where the WildFire analysis security profile is created. If you use a unique URL identifier for the name flag, you can omit the ORGANIZATION_ID flag.

    • BILLING_PROJECT_ID: the project ID to use for billing and quotas.

    • FILE_TYPE1,FILE_TYPE2: types of files that will be submitted to WildFire for analysis. FILE_TYPE must be one of: ANY_FILE, PE. Note that if ANY_FILE is specified, no other types should be specified.

    • DIRECTION: direction of traffic that will be checked for files to submit to WildFire. Direction must be one of: Upload, Download, Both.

    • ACTION: action to take when a threat is detected by WildFire inline cloud analysis. Action must be one of: Allow, Alert, Deny.

  5. Optional: To add inline ML file exceptions, run the gcloud beta network-security security-profiles wildfire-analysis add-inline-ml-exception command:

    gcloud beta network-security security-profiles wildfire-analysis add-inline-ml-exception NAME \
    --location=LOCATION \
    --organization=ORGANIZATION_ID \
    --project=BILLING_PROJECT_ID \
    --partial-hash=PARTIAL_HASH \
    --filename=FILENAME

    Replace the following:

    • NAME: the name of the WildFire analysis security profile.

    • LOCATION: the location of the WildFire analysis security profile.

      Location is always set to global. If you use a unique URL identifier for the NAME flag, you can omit the LOCATION flag.

    • ORGANIZATION_ID: the organization where the WildFire analysis security profile is created. If you use a unique URL identifier for the name flag, you can omit the ORGANIZATION_ID flag.

    • BILLING_PROJECT_ID: the project ID to use for billing and quotas.

    • PARTIAL_HASH: the ML partial hash of the file.

    • FILENAME: name of the partial hash file.

List WildFire analysis security profile

You can list all the WildFire analysis security profiles in an organization.

Console

  1. In the Google Cloud console, go to the Security profiles page.

    Go to Security profiles

  2. In the project selector menu, select your organization.

  3. Select the Security profiles tab. The tab shows a list of configured security profiles.

  4. To filter the security profile with profile type, enter Profile type and then WildFire analysis in the Filter search bar.

gcloud

To list all the WildFire analysis security profiles, use the gcloud beta network-security security-profiles wildfire-analysis list command:

gcloud beta network-security security-profiles wildfire-analysis list \
    --organization ORGANIZATION_ID \
    --location LOCATION

Replace the following:

  • ORGANIZATION_ID: the organization where the WildFire analysis security profiles are created.

  • LOCATION: the location of the WildFire analysis security profiles. Location is always set to global.

Update a WildFire analysis security profile

You can update the details of a specific WildFire analysis security profile in an organization.

Console

  1. In the Google Cloud console, go to the Security profiles page.

    Go to Security profiles

  2. In the project selector menu, select your organization.

  3. Select the Security profiles tab. The tab shows a list of configured security profiles.

  4. Click a security profile of type WildFire analysis to view the profile details.

  5. Click Edit.

gcloud

To update the details of a WildFire analysis security profile, use the gcloud beta network-security security-profiles wildfire-analysis update command:

gcloud beta network-security security-profiles wildfire-analysis update NAME \
    --organization ORGANIZATION_ID \
    --project PROJECT_ID \
    --location LOCATION \
    [--[no-]wildfire-realtime-lookup |
     --[no-]analyze-windows-executables |
     --[no-]analyze-powershell-script-1 |
     --[no-]analyze-powershell-script-2 |
     --[no-]analyze-elf |
     --[no-]analyze-ms-office |
     --[no-]analyze-shell |
     --[no-]analyze-ooxml |
     --[no-]analyze-macho]

Replace the following:

  • NAME: the name of the security profile of type WILDFIRE_ANALYSIS that you want to update.

  • ORGANIZATION_ID: the organization where the WildFire analysis security profile is created. If you use a unique URL identifier for the NAME flag, you can omit the ORGANIZATION_ID flag.

  • LOCATION: the location of the WildFire analysis security profile. Location is always set to global. If you use a unique URL identifier for the NAME flag, you can omit the LOCATION flag.

View a WildFire analysis security profile

You can view a specific WildFire analysis security profile in an organization.

Console

  1. In the Google Cloud console, go to the Security profiles page.

    Go to Security profiles

  2. In the project selector menu, select your organization.

  3. Select the Security profiles tab. The tab shows a list of configured security profiles.

  4. Click a security profile of type WildFire analysis to view the profile details.

gcloud

To view the details of a WildFire analysis security profile, use the gcloud beta network-security security-profiles wildfire-analysis describe command:

gcloud beta network-security security-profiles wildfire-analysis describe NAME \
    [ --organization ORGANIZATION_ID | --project PROJECT_ID ] \
    --location LOCATION

Replace the following:

  • NAME: the name of the security profile of type WILDFIRE_ANALYSIS that you want to describe; you can specify the name as a string or as a unique URL identifier.

  • ORGANIZATION_ID: the organization ID where the WildFire analysis security profile exists. If you use a unique URL identifier for the NAME flag, you can omit the ORGANIZATION_ID flag.

  • PROJECT_ID: the project ID where the WildFire analysis security profile exists. If you use a unique URL identifier for the NAME flag, you can omit the PROJECT_ID flag.

  • LOCATION: the location of the WildFire analysis security profile. Location is always set to global. If you use a unique URL identifier for the NAME flag, you can omit the LOCATION flag.

For example, to describe a security profile named MySecurityProfile by using its unique URL identifier, run the following command:

gcloud beta network-security security-profiles wildfire-analysis describe organizations/123456789012/locations/global/securityProfiles/MySecurityProfile

Delete a WildFire analysis security profile

You can delete a WildFire analysis security profile by specifying its name, location, and organization. However, if a security profile group references the WildFire analysis security profile, you must remove the security profile from the security profile group before you can delete it.

Console

  1. In the Google Cloud console, go to the Security profiles page.

    Go to Security profiles

  2. In the project selector menu, select your organization.

  3. Select the Security profiles tab. The tab shows a list of configured security profiles.

  4. Select the WildFire analysis security profile that you want to delete, and then click Delete.

  5. Click Delete again to confirm.

gcloud

To delete a WildFire analysis security profile, use the gcloud beta network-security security-profiles wildfire-analysis delete command:

gcloud beta network-security security-profiles wildfire-analysis delete NAME \
    --organization ORGANIZATION_ID \
    --location LOCATION

Replace the following:

  • NAME: the name of the WildFire analysis security profile that you want to delete; you can specify the name as a string or as a unique URL identifier.

  • ORGANIZATION_ID: the organization where the WildFire analysis security profile is created. If you use a unique URL identifier for the NAME flag, you can omit the ORGANIZATION_ID flag.

  • LOCATION: the location of the WildFire analysis security profile. Location is always set to global. If you use a unique URL identifier for the NAME flag, you can omit the LOCATION flag.

Delete signature override

gcloud

To delete a signature override or exception, run the gcloud beta network-security security-profiles wildfire-analysis delete-override command:

gcloud beta network-security security-profiles wildfire-analysis delete-override NAME \
    --location=global \
    --organization=ORGANIZATION_ID \
    --project=BILLING_PROJECT_ID \
    --threat-ids=599805

Replace the following:

  • NAME: the name of the WildFire analysis security profile.

  • ORGANIZATION_ID: the organization where the WildFire analysis security profile is created. If you use a unique URL identifier for the name flag, you can omit the ORGANIZATION_ID flag.

  • BILLING_PROJECT_ID: the project ID to use for billing and quotas.

Delete submission rule

gcloud

To delete a submission rule, run the gcloud beta network-security security-profiles wildfire-analysis delete-submission-rule command:

gcloud beta network-security security-profiles wildfire-analysis delete-submission-rule NAME \
    --location=global \
    --organization=ORGANIZATION_ID \
    --project=BILLING_PROJECT_ID \
    --file-types=ANY_FILE \
    --direction=both

Replace the following:

  • NAME: the name of the WildFire analysis security profile.

  • ORGANIZATION_ID: the organization where the WildFire analysis security profile is created. If you use a unique URL identifier for the name flag, you can omit the ORGANIZATION_ID flag.

  • BILLING_PROJECT_ID: the project ID to use for billing and quotas.

Delete inline ML exception

gcloud

To delete an inline ML exception, run the gcloud beta network-security security-profiles wildfire-analysis delete-inline-ml-exception command:

gcloud beta network-security security-profiles wildfire-analysis delete-inline-ml-exception NAME \
    --location=global \
    --organization=ORGANIZATION_ID \
    --project=BILLING_PROJECT_ID \
    --partial-hash=PARTIAL_HASH \
    --filename=FILENAME

Replace the following:

  • NAME: the name of the WildFire analysis security profile.

  • ORGANIZATION_ID: the organization where the WildFire analysis security profile is created. If you use a unique URL identifier for the name flag, you can omit the ORGANIZATION_ID flag.

  • BILLING_PROJECT_ID: the project ID to use for billing and quotas.

  • PARTIAL_HASH: the ML partial hash of the file.

  • FILENAME: name of the partial hash file.

What's next