A customer claims that Advanced WildFire miscategorized a file as malicious and wants proof, because another vendor has said that the file is benign…

Advanced WildFire is Palo Alto Networks' cloud-based malware analysis and prevention solution. It

determines whether files are malicious by executing them in a sandbox environment and observing

their behavior. To address the customer's concern about the file categorization, the systems engineer

must provide evidence of the file's behavior. Here’s the analysis of each option:

Option A: Review the threat logs for information to provide to the customer

Threat logs can provide a summary of events and verdicts for malicious files, but they do not include

the detailed behavior analysis needed to convince the customer.

While reviewing the logs is helpful as a preliminary step, it does not provide the level of proof the

customer needs.

This option is not sufficient on its own.

Option B: Use the WildFire Analysis Report in the log to show the customer the malicious actions the

file took when it was detonated

WildFire generates an analysis report that includes details about the file's behavior during

detonation in the sandbox, such as network activity, file modifications, process executions, and any

indicators of compromise (IoCs).

This report provides concrete evidence to demonstrate why the file was flagged as malicious. It is the

most accurate way to assure the customer that WildFire's decision was based on observed malicious

actions.

This is the best option.

Option C: Open a TAG ticket for the customer and allow support engineers to determine the

appropriate action

While opening a support ticket is a valid action for further analysis or appeal, it is not a direct way to

assure the customer of the current WildFire verdict.

This option does not directly address the customer’s request for immediate proof.

This option is not ideal.

Option D: Do nothing because the customer will realize Advanced WildFire is right

This approach is dismissive of the customer's concerns and does not provide any evidence to support

WildFire's decision.

This option is inappropriate.

Reference:

Palo Alto Networks documentation on WildFire

WildFire Analysis Reports