Create and manage Advanced malware sandbox security profiles

This page shows you how to create, view, update, and delete Advanced malware sandbox (WildFire) security profiles of the WILDFIRE_ANALYSIS type by using the Google Cloud console and the Google Cloud CLI.

WILDFIRE_ANALYSIS security profiles define file inspection rules, supported file categories, and inline cloud analysis options for advanced malware sandboxing. For more information about how security profiles work within policy groups, see the Security profile overview.

Before you begin

Roles

To get the permissions that you need to create, view, update, or delete security profiles, ask your administrator to grant you the necessary Identity and Access Management (IAM) roles on your organization. For more information about granting roles, see Manage access to projects, folders, and organizations.

To monitor long-running operations triggered by the tasks on this page, you also need the Compute Network User (roles/compute.networkUser) role or a custom role containing the following permissions:

  • networksecurity.operations.get
  • networksecurity.operations.list

Create an Advanced malware sandbox security profile

When you create an Advanced malware sandbox security profile, you can specify the name of the security profile as a string or as a unique URL identifier.

You can construct the unique URL identifier for the security profile in the following formats:

  • Organization-scoped:

    organizations/ORGANIZATION_ID/locations/global/securityProfiles/SECURITY_PROFILE_NAME

  • Project-scoped:

    projects/PROJECT_ID/locations/global/securityProfiles/SECURITY_PROFILE_NAME

When you use a unique URL identifier, it must contain the security profile name, the organization or project, and the location (which is always set to global). Using a unique URL identifier lets you reference the security profile in other resources (such as security profile groups) or run gcloud commands without specifying the organization, project, or location flags separately.

For more information about unique URL identifiers, see Security profile specifications.

Console

  1. In the Google Cloud console, go to the Security profiles page.

    Go to Security profiles

  2. In the project selector menu, select your organization.

  3. Select the Security profiles tab.

  4. Click Create profile.

  5. Enter a name in the Name field.

  6. Optional: Enter a description in the Description field.

  7. To create a Cloud Next Generation Firewall Enterprise security profile, in the Purpose section, select Cloud NGFW Enterprise.

  8. To create a Advanced malware sandbox security profile, in the Type section, select Advanced malware sandbox (WildFire).

  9. To prevent the transfer of known malware, select the Hold on real-time signature look up checkbox.

  10. Optional: To set the Advanced malware sandbox overrides, do one or both of the following:

    • In the Signature overrides section, do the following:

      1. Click Add signature by ID.

      2. Enter the signature ID for which you want to override actions.

      3. From the Override action drop-down list, select one of the following:

        • Default: the packet takes the predefined default action specific to that individual threat signature.
        • Allow: the packet matching the firewall policy rule allows the connection.

      4. Click Add signature.

    • In the Protocol overrides section, do the following:

      1. Click  Edit for the Protocol that you want to override. For example, HTTP, SMTP, or FTP.
      2. From the Action drop-down list, select the action. For example, Alert, Allow, or Deny.
      3. From the Inline ML action drop-down list, select the action. For example, Alert, Allow, or Deny.
      4. Click Confirm.

  11. Optional: In the Submission rules section, do the following:

    1. Click Create rule.
    2. For File types, select Any or Specific.

    3. For Direction, do one of the following:

      • Upload and download: the firewall monitors traffic in both the upload and download directions for submission rules.
      • Upload: the firewall monitors only outgoing traffic (uploads) for files to submit.
      • Download: the firewall monitors only incoming traffic (downloads) for files to submit.

    4. Click Create.

  12. Optional: In the Inline cloud analysis rules section, do the following:

    1. Click Create rule.
    2. For File types, select Any or PE.

    3. For Direction, do one of the following:

      • Upload and download: the firewall monitors traffic in both the upload and download directions for inline cloud analysis.
      • Download: the firewall monitors only incoming traffic (downloads) for inline cloud analysis.

    4. From the Action drop-down list, select one of the following:

      • Alert: the packet is allowed to communicate, but the firewall rule generates a threat_log entry sent to the consumer project.
      • Allow: the packet matching the firewall policy rule allows the connection.
      • Deny: the packet and all subsequent packets belonging to the same connection drop completely. The firewall rule also generates a threat_log entry.

    5. Click Create.

  13. Optional: In the Inline ML configuration section, do the following:

    1. Click  Edit for the File type that you want to configure. For example, ELF, Shell, or Macho.
    2. From the Action drop-down list, select the action. For example, Alert or Enable.
    3. Click Confirm.

  14. Optional: In the Inline ML file exceptions section, do the following:

    1. Click Add exception.
    2. Enter the filename that you want to exclude from Advanced malware sandbox inline machine learning (ML) analysis.
    3. Enter the ML partial hash of the file that you want to exclude from Advanced malware sandbox inline ML analysis.
    4. Click Create.

  15. Click Create.

gcloud

  1. To create an Advanced malware sandbox security profile, run the gcloud beta network-security security-profiles wildfire-analysis create command:

    gcloud beta network-security security-profiles wildfire-analysis create NAME \
    --location=LOCATION \
    --organization=ORGANIZATION_ID \
    --project=PROJECT_ID \
    --description=DESCRIPTION

    Replace the following:

    • NAME: the name of the Advanced malware sandbox security profile; you can specify the name as a string or as a unique URL identifier.

      If you use a unique URL identifier for the NAME flag, you can omit the LOCATION and ORGANIZATION flags.

    • LOCATION: the location of the Advanced malware sandbox security profile.

      Location is always set to global. If you use a unique URL identifier for the NAME flag, you can omit the LOCATION flag.

    • ORGANIZATION_ID: the organization where the Advanced malware sandbox security profile is created. If you use a unique URL identifier for the name flag, you can omit the ORGANIZATION_ID flag.

    • PROJECT_ID: the project ID of the Advanced malware sandbox security profile.

    • DESCRIPTION: an optional description for the Advanced malware sandbox security profile.

  2. Optional: To add and manage signature overrides, you can use one or more of the following options:

    gcloud beta network-security security-profiles wildfire-analysis add-override NAME \
    --location=global \
    --organization=ORGANIZATION_ID \
    --project=BILLING_PROJECT_ID \
    --wildfire=HTTP,SMTP \
    --action=DENY

    gcloud beta network-security security-profiles wildfire-analysis add-override NAME \
    --location=global \
    --organization=ORGANIZATION_ID \
    --project=BILLING_PROJECT_ID \
    --wildfire-inline-ml=HTTP \
    --action=DENY

    gcloud beta network-security security-profiles wildfire-analysis add-override NAME \
    --location=global \
    --organization=ORGANIZATION_ID \
    --project=BILLING_PROJECT_ID \
    --threat-ids=599805 \
    --action=ALLOW

    Replace the following parameters based on your selection:

    • NAME: the name of the Advanced malware sandbox security profile.
    • ORGANIZATION_ID: the organization ID.
    • BILLING_PROJECT_ID: the project ID used for billing and quotas.
    • --wildfire: the protocols to override the action for. Must be one of: SMTP, SMB, POP3, IMAP, HTTP2, HTTP, FTP.
    • --wildfire-inline-ml: local inline ML threats protocol override option.
    • --threat-ids: threat signature IDs to override. Note that the action must be Default or Allow.
    • ACTION: action to apply. Must be one of: Default, Allow, Deny, or Alert.

  3. Optional: To configure submission rules, run the gcloud beta network-security security-profiles wildfire-analysis add-submission-rule command:

    gcloud beta network-security security-profiles wildfire-analysis add-submission-rule NAME \
    --location=LOCATION \
    --organization=ORGANIZATION_ID \
    --project=BILLING_PROJECT_ID \
    --file-types=FILE_TYPE1,FILE_TYPE2,... \
    --direction=DIRECTION

    Replace the following:

    • NAME: the name of the Advanced malware sandbox security profile.

    • LOCATION: the location of the Advanced malware sandbox security profile.

      Location is always set to global. If you use a unique URL identifier for the NAME flag, you can omit the LOCATION flag.

    • ORGANIZATION_ID: the organization where the Advanced malware sandbox security profile is created. If you use a unique URL identifier for the name flag, you can omit the ORGANIZATION_ID flag.

    • BILLING_PROJECT_ID: the project ID to use for billing and quotas.

    • FILE_TYPE1,FILE_TYPE2: types of files that will be submitted to Advanced malware sandbox for analysis. File type must be one of: ANY_FILE, APK, ARCHIVE, EMAIL_LINK, FLASH, JAR, LINUX, MS_OFFICE, PDF, PE, SCRIPT. Note that if ANY_FILE is specified, no other types should be specified.

    • DIRECTION: direction of traffic that will be checked for files to submit to Advanced malware sandbox. Direction must be one of: Upload, Download, Both.

  4. Optional: To configure inline cloud analysis rules, run the gcloud beta network-security security-profiles wildfire-analysis add-inline-cloud-analysis-rule command:

    gcloud beta network-security security-profiles wildfire-analysis add-inline-cloud-analysis-rule NAME \
    --location=LOCATION \
    --organization=ORGANIZATION_ID \
    --project=BILLING_PROJECT_ID \
    --file-types=FILE_TYPE1,FILE_TYPE2,... \
    --direction=DIRECTION \
    --action=ACTION

    Replace the following:

    • NAME: the name of the Advanced malware sandbox security profile.

    • LOCATION: the location of the Advanced malware sandbox security profile.

      Location is always set to global. If you use a unique URL identifier for the NAME flag, you can omit the LOCATION flag.

    • ORGANIZATION_ID: the organization where the Advanced malware sandbox security profile is created. If you use a unique URL identifier for the name flag, you can omit the ORGANIZATION_ID flag.

    • BILLING_PROJECT_ID: the project ID to use for billing and quotas.

    • FILE_TYPE1,FILE_TYPE2: types of files that will be submitted to Advanced malware sandbox for analysis. FILE_TYPE must be one of: ANY_FILE, PE. Note that if ANY_FILE is specified, no other types should be specified.

    • DIRECTION: direction of traffic that will be checked for files to submit to Advanced malware sandbox. Direction must be one of: Upload, Download, Both.

    • ACTION: action to take when a threat is detected by Advanced malware sandbox inline cloud analysis. Action must be one of: Allow, Alert, Deny.

  5. Optional: To add inline ML file exceptions, run the gcloud beta network-security security-profiles wildfire-analysis add-inline-ml-exception command:

    gcloud beta network-security security-profiles wildfire-analysis add-inline-ml-exception NAME \
    --location=LOCATION \
    --organization=ORGANIZATION_ID \
    --project=BILLING_PROJECT_ID \
    --partial-hash=PARTIAL_HASH \
    --filename=FILENAME

    Replace the following:

    • NAME: the name of the Advanced malware sandbox security profile.

    • LOCATION: the location of the Advanced malware sandbox security profile.

      Location is always set to global. If you use a unique URL identifier for the NAME flag, you can omit the LOCATION flag.

    • ORGANIZATION_ID: the organization where the Advanced malware sandbox security profile is created. If you use a unique URL identifier for the name flag, you can omit the ORGANIZATION_ID flag.

    • BILLING_PROJECT_ID: the project ID to use for billing and quotas.

    • PARTIAL_HASH: the ML partial hash of the file.

    • FILENAME: the name of the file to exclude.

List Advanced malware sandbox security profiles

You can list all the Advanced malware sandbox security profiles in an organization.

Console

  1. In the Google Cloud console, go to the Security profiles page.

    Go to Security profiles

  2. In the project selector menu, select your organization.

  3. Select the Security profiles tab. The tab shows a list of configured security profiles.

  4. To filter security profiles by profile type, enter Profile type and then select Advanced malware sandbox (WildFire) in the Filter search box.

gcloud

To list all the Advanced malware sandbox security profiles, use the gcloud beta network-security security-profiles wildfire-analysis list command:

gcloud beta network-security security-profiles wildfire-analysis list \
    --organization ORGANIZATION_ID \
    --location LOCATION

Replace the following:

  • ORGANIZATION_ID: the organization where the Advanced malware sandbox security profiles are created.

  • LOCATION: the location of the Advanced malware sandbox security profiles. Location is always set to global.

Update an Advanced malware sandbox security profile

You can update the details of a specific Advanced malware sandbox security profile in an organization.

Console

  1. In the Google Cloud console, go to the Security profiles page.

    Go to Security profiles

  2. In the project selector menu, select your organization.

  3. Select the Security profiles tab. The tab shows a list of configured security profiles.

  4. Click a security profile of type Advanced malware sandbox (WildFire) to view the profile details.

  5. Click Edit.

gcloud

To update the details of a Advanced malware sandbox security profile, use the gcloud beta network-security security-profiles wildfire-analysis update command:

gcloud beta network-security security-profiles wildfire-analysis update NAME \
    --organization ORGANIZATION_ID \
    --project PROJECT_ID \
    --location LOCATION \
    [--[no-]wildfire-realtime-lookup |
     --[no-]analyze-windows-executables |
     --[no-]analyze-powershell-script-1 |
     --[no-]analyze-powershell-script-2 |
     --[no-]analyze-elf |
     --[no-]analyze-ms-office |
     --[no-]analyze-shell |
     --[no-]analyze-ooxml |
     --[no-]analyze-macho]

Replace the following:

  • NAME: the name of the security profile of type WILDFIRE_ANALYSIS that you want to update.

  • ORGANIZATION_ID: the organization where the Advanced malware sandbox security profile is created. If you use a unique URL identifier for the NAME flag, you can omit the ORGANIZATION_ID flag.

  • LOCATION: the location of the Advanced malware sandbox security profile. Location is always set to global. If you use a unique URL identifier for the NAME flag, you can omit the LOCATION flag.

View an Advanced malware sandbox security profile

You can view a specific Advanced malware sandbox security profile in an organization.

Console

  1. In the Google Cloud console, go to the Security profiles page.

    Go to Security profiles

  2. In the project selector menu, select your organization.

  3. Select the Security profiles tab. The tab shows a list of configured security profiles.

  4. Click a security profile of type Advanced malware sandbox (WildFire) to view the profile details.

gcloud

To view the details of an Advanced malware sandbox security profile, use the gcloud beta network-security security-profiles wildfire-analysis describe command:

gcloud beta network-security security-profiles wildfire-analysis describe NAME \
    [ --organization ORGANIZATION_ID | --project PROJECT_ID ] \
    --location LOCATION

Replace the following:

  • NAME: the name of the security profile of type WILDFIRE_ANALYSIS that you want to describe; you can specify the name as a string or as a unique URL identifier.

  • ORGANIZATION_ID: the organization ID where the Advanced malware sandbox security profile exists. If you use a unique URL identifier for the NAME flag, you can omit the ORGANIZATION_ID flag.

  • PROJECT_ID: the project ID where the Advanced malware sandbox security profile exists. If you use a unique URL identifier for the NAME flag, you can omit the PROJECT_ID flag.

  • LOCATION: the location of the Advanced malware sandbox security profile. Location is always set to global. If you use a unique URL identifier for the NAME flag, you can omit the LOCATION flag.

For example, to describe a security profile named MySecurityProfile by using its unique URL identifier, run the following command:

gcloud beta network-security security-profiles wildfire-analysis describe organizations/123456789012/locations/global/securityProfiles/MySecurityProfile

Delete an Advanced malware sandbox security profile

You can delete a Advanced malware sandbox security profile by specifying its name, location, and organization. However, if a security profile group references the Advanced malware sandbox security profile, you must remove the security profile from the security profile group before you can delete it.

Console

  1. In the Google Cloud console, go to the Security profiles page.

    Go to Security profiles

  2. In the project selector menu, select your organization.

  3. Select the Security profiles tab. The tab shows a list of configured security profiles.

  4. Select the Advanced malware sandbox security profile that you want to delete, and then click Delete.

  5. Click Delete again to confirm.

gcloud

To delete a Advanced malware sandbox security profile, use the gcloud beta network-security security-profiles wildfire-analysis delete command:

gcloud beta network-security security-profiles wildfire-analysis delete NAME \
    --organization ORGANIZATION_ID \
    --location LOCATION

Replace the following:

  • NAME: the name of the Advanced malware sandbox security profile that you want to delete; you can specify the name as a string or as a unique URL identifier.

  • ORGANIZATION_ID: the organization where the Advanced malware sandbox security profile is created. If you use a unique URL identifier for the NAME flag, you can omit the ORGANIZATION_ID flag.

  • LOCATION: the location of the Advanced malware sandbox security profile. Location is always set to global. If you use a unique URL identifier for the NAME flag, you can omit the LOCATION flag.

Delete a signature override

gcloud

To delete a signature override or exception, run the gcloud beta network-security security-profiles wildfire-analysis delete-override command:

gcloud beta network-security security-profiles wildfire-analysis delete-override NAME \
    --location=global \
    --organization=ORGANIZATION_ID \
    --project=BILLING_PROJECT_ID \
    --threat-ids=599805

Replace the following:

  • NAME: the name of the Advanced malware sandbox security profile.

  • ORGANIZATION_ID: the organization where the Advanced malware sandbox security profile is created. If you use a unique URL identifier for the name flag, you can omit the ORGANIZATION_ID flag.

  • BILLING_PROJECT_ID: the project ID to use for billing and quotas.

Delete a submission rule

gcloud

To delete a submission rule, run the gcloud beta network-security security-profiles wildfire-analysis delete-submission-rule command:

gcloud beta network-security security-profiles wildfire-analysis delete-submission-rule NAME \
    --location=global \
    --organization=ORGANIZATION_ID \
    --project=BILLING_PROJECT_ID \
    --file-types=ANY_FILE \
    --direction=both

Replace the following:

  • NAME: the name of the Advanced malware sandbox security profile.

  • ORGANIZATION_ID: the organization where the Advanced malware sandbox security profile is created. If you use a unique URL identifier for the name flag, you can omit the ORGANIZATION_ID flag.

  • BILLING_PROJECT_ID: the project ID to use for billing and quotas.

Delete an inline ML exception

gcloud

To delete an inline ML exception, run the gcloud beta network-security security-profiles wildfire-analysis delete-inline-ml-exception command:

gcloud beta network-security security-profiles wildfire-analysis delete-inline-ml-exception NAME \
    --location=global \
    --organization=ORGANIZATION_ID \
    --project=BILLING_PROJECT_ID \
    --partial-hash=PARTIAL_HASH \
    --filename=FILENAME

Replace the following:

  • NAME: the name of the Advanced malware sandbox security profile.

  • ORGANIZATION_ID: the organization where the Advanced malware sandbox security profile is created. If you use a unique URL identifier for the name flag, you can omit the ORGANIZATION_ID flag.

  • BILLING_PROJECT_ID: the project ID to use for billing and quotas.

  • PARTIAL_HASH: the ML partial hash of the file.

  • FILENAME: the name of the file to exclude.

What's next