Advanced malware sandbox overview

The Advanced malware sandbox (WildFire) service for Cloud Next Generation Firewall provides malware protection using inline machine learning (ML) and cloud-based behavioral sandboxing. Powered by Palo Alto Networks Advanced WildFire, the service extends standard signature-based intrusion detection and prevention service by evaluating suspicious files in real time to prevent zero-day threats from reaching your workloads.

Advanced malware sandbox is included as part of the Cloud Next Generation Firewall Enterprise capabilities. For details, see Pricing and Quotas and limits.

This document provides an overview of Advanced malware sandbox capabilities, architecture, core components, supported file types, and service regions.

Benefits of using Advanced malware sandbox

Integrating Advanced malware sandbox into Cloud Next Generation Firewall Enterprise provides the following capabilities:

• Protection against unknown and zero-day threats: detects and blocks novel or highly customized malware that lacks established signatures.

• Inline dataplane protection: intercepts and analyzes file transfers in real time directly on zonal firewall endpoints and through cloud lookups to minimize threat exposure.

• Adaptive threat intelligence: automatically incorporates newly discovered threat verdicts into local signature databases.

• Actionable visibility and forensics: Advanced malware sandbox generates detailed submission logs and threat logs that integrate directly with Cloud Logging. If a threat is detected, you can download detailed analysis reports of the sandbox execution and download the actual malware sample for independent Security Operations Center (SOC) analysis.

How Advanced malware sandbox works

Advanced malware sandbox inspects network-routed file transfers by intercepting packets, performing high-speed local checks, and offloading advanced behavior sandboxing to the cloud when necessary.

The following Advanced malware sandbox architecture diagram shows packet interception from a Virtual Private Cloud (VPC) network virtual machine (VM) to a zonal firewall endpoint, parallel evaluation by the inline ML engine and signature database, real-time cloud lookups, and asynchronous cloud sandboxing.

The integration processes and evaluates file transfers through the following stages:

Traffic interception and redirection

When a VM instance inside your VPC network initiates a connection or file transfer, the firewall policy rule redirects the flow as follows:

1. Packet interception: The Google Cloud Packet Intercept network component captures packets in the traffic stream.
2. Redirection: The intercept component redirects the network packets to the zonal firewall endpoint for Layer 7 inspection.

Inline local evaluation

After traffic is redirected to the firewall endpoint, the file is analyzed in parallel by two inline, high-performance engines:

• Signature-based detection: the endpoint compares the file against a local threat signature database. This database is updated in real-time to detect and drop recognized malicious files.

• Inline ML: the inline ML engine runs ML models directly in the firewall dataplane. It analyzes the file in real-time to identify zero-day or highly sophisticated threats in supported file types such as Windows_Executable, ELF, Powershell_Script, and MS_Office.

Cloud-based advanced inspection

For zero-day threats or files with unrecognized local signatures, Advanced malware sandbox uses advanced cloud analysis:

• Inline cloud analysis: if enabled in the security profile, the firewall temporarily holds the file transfer while performing a real-time lookup in the Advanced malware sandbox cloud. The cloud evaluates the file and sends a signal back before the file reaches your network.

  The Advanced malware sandbox cloud is a partner Software as a Service (SaaS) platform hosted in Google Cloud and operated by Palo Alto Networks (PAN). It provides deep, asynchronous malware analysis and real-time threat evaluation.

• Asynchronous cloud sandbox: if the file verdict is unknown, the firewall extracts the file and uploads it asynchronously to the Advanced malware sandbox cloud for deep sandboxing. In this isolated container environment, security engines execute the file and audit its behavior.

Action enforcement and logging

Based on the resulting verdict (Malware, Grayware, or Benign), the firewall rule enforces the policy as follows:

1. Enforce action: the file is either blocked (Deny), recorded (Alert), or permitted (Allow) in accordance with your Advanced malware sandbox security profile.

2. Audit logs: event logs are recorded in Cloud Logging, specifically the firewall_wildfire_submission log. These submission logs are displayed on the Advanced malware sandbox submission dashboard and page.

3. Sandbox feedback: after asynchronous sandboxing completes, a full behavioral report and the original malware samples are synchronized out-of-band and made available for you to query or retrieve.

Components of Advanced malware sandbox

To use Advanced malware sandbox, you must configure the following components:

Security profiles and security profile groups

• Advanced malware sandbox security profiles: generic policy structures of WILDFIRE_ANALYSIS type. They define which file types are submitted for analysis and the direction of traffic. For more information, see Advanced malware sandbox security profile.

  For information on Advanced malware sandbox security profile configuration, see Create and manage Advanced malware sandbox security profiles.

• Security profile groups: act as containers for security profiles. Each group contains one or more security profiles of different types. Note that an intrusion detection and prevention service security profile is required when you include a Advanced malware sandbox security profile in a group.

  For more information, see