Manage WildFire submissions

When Cloud Next Generation Firewall Enterprise detects unknown files or potential real-time threats in your network, it evaluates the traffic using on-box machine learning models and asynchronous cloud sandboxing according to your WildFire analysis security profiles. Before you begin, review the concepts in the WildFire analysis security profile overview.

This page explains how to manage files submitted to the WildFire service for analysis, monitor malware sandboxing results, and track dynamic verdicts using the Google Cloud console and gcloud.

Use the WildFire submissions tab on the NGFW Enterprise logs page to audit file submissions, download analysis reports or malware samples, and change verdict overrides. To view a summary of the WildFire submissions file analysis activity and malware detected during a specific timeframe in your network, go to the Cloud NGFW Dashboard.

To learn more about how file submissions work, see WildFire overview.

To understand the JSON layout of the logging record, see WildFire logs.

Roles and permissions

To view the list of submissions and access WildFire data, ask your administrator to grant you the necessary Identity and Access Management (IAM) roles for your organization.

Ability Necessary role
View configuration and basic submission records Compute Network Viewer (roles/compute.networkViewer)
To access dynamic analysis reports, download original malware samples, or submit verdict change requests Any of the following roles on the organization or the project:
  • Compute Network Admin (roles/compute.networkAdmin)
  • The following specific permissions:
    • networksecurity.firewallEndpoints.getWildfireReport for downloading PDF analysis reports.
    • networksecurity.firewallEndpoints.getWildfireSample for downloading original malware sample binaries.
    • networksecurity.firewallEndpoints.createVerdictChangeRequest for filing manual verdict overrides for false positives or false negatives.
    • networksecurity.firewallEndpoints.getVerdictChangeRequest for getting verdict change request details.
    • networksecurity.firewallEndpoints.listVerdictChangeRequests for listing verdict change requests.

For more information about granting roles, see Manage access to projects, folders, and organizations.

Change verdict of a submission

To submit a verdict change request for a file submitted to WildFire by an endpoint, do the following:

Console

  1. In the Google Cloud console, go to the WildFire submissions page.

    Go to WildFire submissions

  2. In the project selector menu, select your project.

  3. To change the verdict of the WildFire submission, click  More actions for the file whose verdict you want to change.

  4. Click Change verdict.

  5. In the Verdict list, select the verdict. For example, Malware, Phishing.

  6. In the Comment field, enter the justification for the verdict change.

  7. Click Create.

gcloud

To submit a verdict change request, use the gcloud beta network-security firewall-endpoints wildfire-verdict-change-requests create command.

gcloud beta network-security firewall-endpoints wildfire-verdict-change-requests create \
    --endpoint ENDPOINT_NAME \
    --organization ORGANIZATION_ID \
    --hash HASH \
    --zone ZONE \
    --verdict VERDICT \
    --comment COMMENT

Replace the following:

  • ENDPOINT_NAME: the unique full name of the endpoint.

  • ORGANIZATION_ID: the organization ID in which the firewall endpoint is located.

  • HASH: the hash of the file to submit a verdict change request for.

  • ZONE: the zone in which the firewall endpoint is located.

  • VERDICT: the verdict requested for the file.

  • COMMENT: the justification for the verdict change request. The maximum length is 2,048 characters.

List verdict change requests

Console

To list individual verdict change requests, do the following:

  1. In the Google Cloud console, go to the WildFire submissions page.

    Go to WildFire submissions

  2. In the project selector menu, select your project.

  3. The WildFire submissions page lists the configured WildFire submissions.

gcloud

To list individual verdict change requests, use the gcloud beta network-security firewall-endpoints wildfire-verdict-change-requests list command.

gcloud beta network-security firewall-endpoints wildfire-verdict-change-requests list \
    --endpoint ENDPOINT_NAME \
    --organization ORGANIZATION_ID \
    --zone ZONE

Replace the following:

  • ENDPOINT_NAME: the unique full name of the endpoint.

  • ORGANIZATION_ID: the organization ID in which to list verdict change requests.

  • ZONE: the zone in which to list verdict change requests.

Get verdict change request details

To get the details of the verdict change request, do the following:

Console

  1. In the Google Cloud console, go to the WildFire submissions page.

    Go to WildFire submissions

  2. In the project selector menu, select your project.

  3. Click the name of the WildFire submission. The submission details page displays the status and details of the verdict change request.

gcloud

To get the details of the verdict change request, use the gcloud beta network-security firewall-endpoints wildfire-verdict-change-requests get command.

gcloud beta network-security firewall-endpoints wildfire-verdict-change-requests get \
    --name NAME \
    --endpoint ENDPOINT_NAME \
    --organization ORGANIZATION_ID \
    --zone ZONE

Replace the following:

  • NAME: the unique name of the verdict change request.

  • ENDPOINT_NAME: the unique full name of the endpoint.

  • ORGANIZATION_ID: the organization ID in which to get the verdict change request.

  • ZONE: the zone in which to get the verdict change request.

Download analysis report

To download the WildFire submission analysis report, do the following:

  1. In the Google Cloud console, go to the WildFire submissions page.

    Go to WildFire submissions

  2. In the project selector menu, select your project.

  3. Click  More actions for the file to download the WildFire analysis report.

  4. Click Download WildFire analysis report.

Download malware sample

To download the malware sample from a WildFire submission, do the following:

  1. In the Google Cloud console, go to the WildFire submissions page.

    Go to WildFire submissions

  2. In the project selector menu, select your project.

  3. Click  More actions for the file to download the malware sample.

  4. Click Download malware sample.

What's next