An administrator with 84 firewalls and Panorama does not see any WildFire logs in Panorama.
All 84 firewalls have an active WildFire subscription. On each firewall, WildFire logs are available.
This issue is occurring because forwarding of which type of logs from the firewalls to Panorama is missing?
Forwarding Threat logs from the firewalls to Panorama is necessary for viewing WildFire logs in Panorama. The firewalls are configured to store and forward logs related to WildFire detections and submissions as Threat logs. Without forwarding these logs, Panorama would not receive the necessary WildFire data.
It's C, threat logs "Access to the WildFire logs from Panorama requires the following: a WildFire subscription, a File Blocking profile that is attached to a Security rule, and Threat log forwarding to Panorama." https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/monitor-network-activity/use-case-respond-to-an-incident-using-panorama/review-wildfire-logs
Looks strange, but it's how it is written in documentation - answer "C"
Confirmed still the same in 10.2 - updated URL link : https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/monitor-network-activity/use-case-respond-to-an-incident-using-panorama/review-wildfire-logs
A is correct
The question asks, "forwarding of which type of logs" is missing from the firewalls? There is a type 'wildfire' in Log Forwarding profile separate from type 'threat.' So has to be A.
The real exam question will have better wording. Watch out for either Wildfire Submission logs, or Wildfire Virus entries. A: would be for wildfire submission logs C: would be for wildfire-virus logs Based on this question, i go for A
The correct answer is A, I have checked in my lab.
Access to the WildFire logs from Panorama requires the following: a WildFire subscription, a File Blocking profile that is attached to a Security rule, and Threat log forwarding to Panorama. (https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/monitor-network-activity/use-case-respond-to-an-incident-using-panorama/review-wildfire-logs) In the NGFW go to: Objects > Log forwarding > add a log profile > log type Wildfire https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/monitoring/configure-log-forwarding On that page they talk about: Create a Log Forwarding profile. "The profile defines the destinations for Traffic, Threat, WildFire Submission, URL Filtering, Data Filtering, Tunnel and Authentication logs" But if you check the config is called "WildFire" and not "WildFire Submission" So you both right? Depends on which log you talking about.
Access to the WildFire logs from Panorama requires the following: a WildFire subscription, a File Blocking profile that is attached to a Security rule, and Threat log forwarding to Panorama. https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/monitor-network-activity/use-case-respond-to-an-incident-using-panorama/review-wildfire-logs
Answer is C
Answer is A, read the question "This issue is occurring because forwarding of which type of logs FROM the firewalls to Panorama is missing?" So log forwarding config is firewall is missing.
Jeepers is it A or C???
Access to the WildFire logs from Panorama requires the following: a WildFire subscription, a File Blocking profile that is attached to a Security rule, and Threat log forwarding to Panorama.
C is correct
Answer is C. Access to the WildFire logs from Panorama requires the following: a WildFire subscription, a File Blocking profile that is attached to a Security rule, and Threat log forwarding to Panorama.
So "C" is correct the answer. If we want to view WildFire log on Panorama, required to have an active WildFire subscription and File blocking profile attached to security rule and configure threats logs to Panorama as well. The questions is asking, which type of log are missing on Panorama? they did't mentioned. about threat log has configure or not. Meaning, The threats log may not been configured. Following official documentation: https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/monitor-network-activity/use-case-respond-to-an-incident-using-panorama/review-wildfire-logs Regards, KH29
Confirmed still the same in 10.2 - updated URL link : https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/monitor-network-activity/use-case-respond-to-an-incident-using-panorama/review-wildfire-logs
Answer C Based on the links provided in other comments, C is the correct answer, even if there is a log type called 'wildfire' in the Log Forwarding Profile.
correction: #405. not #425