Manage Advanced malware sandbox submissions

When Cloud Next Generation Firewall Enterprise detects unknown files or potential real-time threats in your network, it evaluates the traffic using on-box machine learning models and asynchronous cloud sandboxing according to your Advanced malware sandbox (WildFire) security profiles. Before you begin, review the concepts in the Advanced malware sandbox security profile overview.

This page explains how to manage files submitted to the Advanced malware sandbox service for analysis, monitor malware sandboxing results, and track dynamic verdicts using the Google Cloud console and gcloud.

Use the Advanced malware sandbox submissions tab on the NGFW Enterprise logs page to audit file submissions, download analysis reports or malware samples, and change verdict overrides. To view a summary of the Advanced malware sandbox submissions file analysis activity and malware detected during a specific timeframe in your network, go to the Cloud NGFW Dashboard.

To learn more about how file submissions work, see Advanced malware sandbox overview.

To understand the JSON layout of the logging record, see Advanced malware sandbox logs.

Roles and permissions

To view the list of submissions and access Advanced malware sandbox data, ask your administrator to grant you the necessary Identity and Access Management (IAM) roles for your organization.

Ability Necessary role
View configuration and basic submission records Compute Network Viewer (roles/compute.networkViewer)
To access dynamic analysis reports, download original malware samples, or submit verdict change requests Any of the following roles on the organization or the project:
  • Compute Network Admin (roles/compute.networkAdmin)
  • The following specific permissions:
    • networksecurity.firewallEndpoints.getWildfireReport for downloading PDF analysis reports.
    • networksecurity.firewallEndpoints.getWildfireSample for downloading original malware sample binaries.
    • networksecurity.firewallEndpoints.createVerdictChangeRequest for filing manual verdict overrides for false positives or false negatives.
    • networksecurity.firewallEndpoints.getVerdictChangeRequest for getting verdict change request details.
    • networksecurity.firewallEndpoints.listVerdictChangeRequests for listing verdict change requests.

For more information about granting roles, see Manage access to projects, folders, and organizations.

Change the verdict of a submission

To submit a verdict change request for a file submitted to Advanced malware sandbox by an endpoint, do the following:

Console

  1. In the Google Cloud console, go to the Advanced malware sandbox submissions page.

    Go to WildFire submissions

  2. In the project selector menu, select your project.

  3. To change the verdict of the Advanced malware sandbox submission, click  More actions for the file whose verdict you want to change.

  4. Click Change verdict.

  5. In the Verdict list, select the verdict. For example, Malware, Phishing.

  6. In the Comment field, enter the justification for the verdict change.

  7. Click Create.

gcloud

To submit a verdict change request, use the gcloud beta network-security firewall-endpoints wildfire-verdict-change-requests create command.

gcloud beta network-security firewall-endpoints wildfire-verdict-change-requests create \
    --endpoint ENDPOINT_NAME \
    --organization ORGANIZATION_ID \
    --hash HASH \
    --zone ZONE \
    --verdict VERDICT \
    --comment COMMENT

Replace the following:

  • ENDPOINT_NAME: the unique full name of the endpoint.

  • ORGANIZATION_ID: the organization ID in which the firewall endpoint is located.

  • HASH: the hash of the file to submit a verdict change request for.

  • ZONE: the zone in which the firewall endpoint is located.

  • VERDICT: the verdict requested for the file.

  • COMMENT: the justification for the verdict change request. The maximum length is 2,048 characters.

List verdict change requests

Console

To list individual verdict change requests, do the following:

  1. In the Google Cloud console, go to the Advanced malware sandbox submissions page.

    Go to WildFire submissions

  2. In the project selector menu, select your project.

  3. The Advanced malware sandbox submissions page lists the configured Advanced malware sandbox submissions.

gcloud

To list individual verdict change requests, use the gcloud beta network-security firewall-endpoints wildfire-verdict-change-requests list command.

gcloud beta network-security firewall-endpoints wildfire-verdict-change-requests list \
    --endpoint ENDPOINT_NAME \
    --organization ORGANIZATION_ID \
    --zone ZONE

Replace the following:

  • ENDPOINT_NAME: the unique full name of the endpoint.

  • ORGANIZATION_ID: the organization ID in which to list verdict change requests.

  • ZONE: the zone in which to list verdict change requests.

Get verdict change request details

To get the details of the verdict change request, do the following:

Console

  1. In the Google Cloud console, go to the Advanced malware sandbox submissions page.

    Go to WildFire submissions

  2. In the project selector menu, select your project.

  3. Click the name of the Advanced malware sandbox submission. The submission details page displays the status and details of the verdict change request.

gcloud

To get the details of the verdict change request, use the gcloud beta network-security firewall-endpoints wildfire-verdict-change-requests get command.

gcloud beta network-security firewall-endpoints wildfire-verdict-change-requests get \
    --name NAME \
    --endpoint ENDPOINT_NAME \
    --organization ORGANIZATION_ID \
    --zone ZONE

Replace the following:

  • NAME: the unique name of the verdict change request.

  • ENDPOINT_NAME: the unique full name of the endpoint.

  • ORGANIZATION_ID: the organization ID in which to get the verdict change request.

  • ZONE: the zone in which to get the verdict change request.

Download an analysis report

To download the Advanced malware sandbox submission analysis report, do the following:

  1. In the Google Cloud console, go to the Advanced malware sandbox submissions page.

    Go to WildFire submissions

  2. In the project selector menu, select your project.

  3. Click  More actions for the file to download the Advanced malware sandbox analysis report.

  4. Click Download analysis report.

Download a malware sample

To download the malware sample from a Advanced malware sandbox submission, do the following:

  1. In the Google Cloud console, go to the Advanced malware sandbox submissions page.

    Go to WildFire submissions

  2. In the project selector menu, select your project.

  3. Click  More actions for the file to download the malware sample.

  4. Click Download malware sample.

What's next