In an existing deployment, an administrator with numerous firewalls and Panorama does not see any WildFire logs in Panorama. Each firewall has an active WildFire subscription. On each firewall, WildFire logs are available.
This issue is occurring because forwarding of which type of logs from the firewalls to Panorama is missing?
The absence of WildFire logs in Panorama, despite their presence on each firewall, suggests that Threat logs are not being forwarded from the firewalls to Panorama. Threat logs include information regarding malware detected by WildFire, so without forwarding Threat logs, Panorama would not display the WildFire log data even though the firewalls have it. Hence, ensuring that Threat logs are forwarded to Panorama should resolve the issue.
Access to the WildFire logs from Panorama requires the following: a WildFire subscription, a File Blocking profile that is attached to a Security rule, and Threat log forwarding to Panorama. https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/monitor-network-activity/use-case-respond-to-an-incident-using-panorama/review-wildfire-logs
The question states that there are no "Wildfire" logs in Panorama but they are on the firewalls. Both Panorama and firewalls have "WildFire Submissions" under Monitor->Logs. If the question were referring to 'wildfire-virus' subtype of Threat logs, I think it would have hinted at that. Also, by saying Wildfire logs are not showing up on the Panorama, it's assumed Threat logs are seen, so C does not fit. Furthermore, 'Wildfire' type logs are an option in the Log Forwarding profile, which the question specifically asks.
On the 1/23/24 test
if we read the question carefully it is asking which log forwarding is causing this issue among the lists below as it is referenced from https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/monitor-network-activity/use-case-respond-to-an-incident-using-panorama/review-wildfire-logs the last one is missing so the answer is defiantly C. Access to the WildFire logs from Panorama requires the following: a WildFire subscription, a File Blocking profile that is attached to a Security rule, and Threat log forwarding to Panorama.
In the log forwarding Profile will be defined all Logs to be forwarded to panorama including WildFire. Selected Answer: B
Access to the WildFire logs from Panorama requires the following: a WildFire subscription, a File Blocking profile that is attached to a Security rule, and Threat log forwarding to Panorama.
B is the correct.
I just test this sceniao with PN + NFGE with 10.1.x PN don't need WF subcription and get WF submissions log from managed device. The managed device just configured log forwarding profile with Wildfire log to forward to.
B. is the answer. Logs produced by Wildfire are seen under Wildfire logs. Logs produced by a Security Profile are seen under the threat log, even if a Wildfire signature matched the threat.
C. Like chrisy042
Wildfire logs profile should be attached to log forwarding profile under policies > security > actions > profile settings. Threat logs are associated with vulnerability profile.
I believe answer is B
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEVCA0 under log settings , there is an option Wildfire
Threat logs shows details about wildfire but since the WF logs are missing then need to send those answer is B
C. see link from Chrisy042.
In the log forwarding Profile will be defined all Logs to be forwarded to panorama including WildFire. Selected Answer: B
agree with C