Examining a WildFire Analysis profiles

A knowledge base article about Examining a WildFire Analysis profiles provided by the UC Berkeley IT Service Hub - Knowledge Portal

Overview

The Information Security Office (ISO) creates security profiles that departments can use within their own firewall environments. To evaluate these profiles for local use, it is recommended to review the specific settings within the management console. The steps below outline how to examine the configurations for WildFire Analysis profiles.

How to Examine WildFire Analysis Profiles

  1. Log into https://panorama.net.berkeley.edu using single sign-on.
  2. Select the Objects tab from the top navigation bar.
  3. Under the Security Profiles menu in the left pane, select WildFire Analysis.
    Panorama sidebar menu with the WildFire Analysis option selected under Security Profiles.
  4. Unlike most other security profiles, ISO has developed one primary WildFire Analysis profile for campus use: ucbsec-wildfire_cloud.
    The WildFire Analysis profile list showing the ucbsec-wildfire_cloud entry.

  5. The settings for the ucbsec-wildfire_cloud profile are configured to send specific file types to the vendor's Gov Cloud WildFire instance for analysis, regardless of the application used or the direction of the traffic (upload/download).

    Note: Like firewall rules, the entries in a WildFire Analysis Profile are processed from top to bottom. The first rule that matches the file type and criteria will be applied.

    Detailed view of the WildFire Analysis rules showing columns for Name, Applications, File Types, and Direction.

    For custom use cases, administrators can designate specific App-ID signatures or traffic directions as part of the match behavior.

    Example: If a researcher regularly downloads known malicious files from a specific Git repository for study, you can create a custom profile to ignore that specific traffic while maintaining standard analysis for all other file transfers.

  6. Once you have finished reviewing the profile settings, click Cancel to exit the screen without making changes.

Additional Resources

For technical documentation on these profiles, visit the vendor support site: WildFire Analysis Profile Documentation.