How to set a File exception or disable WildFire Inline ML model
Environment
- PAN-OS 10.0 or higher
- Active WildFire License
Procedure
If your WildFire Analysis security profile is configured to forward the filetypes analyzed using WildFire inline ML, false-positives are automatically corrected as they are received.
In the event that false positives are observed, customer may proceed setting an exception to allow the trusted file. This is typically done when WildFire Analysis Security Profile is not configured to forward files to WildFire for analysis. Below are 2 methods in setting an exception.
1. Add a File Exception to Antivirus Security Profile by specifying a file from the threat logs.
- Navigate to Threat Logs and click on the "magnifying glass" icon to view Detailed Log, click "Create Exception" for the Partial Hash of the specific file.
- Alternatively, manually copy the Partial Hash and add it under Antivirus Profile (WildFire Inline ML tab).
Note: If you continue to see ml-virus alerts for files that have been classified as benign by WildFire Analysis, please contact Palo Alto Networks Support.
Additional Information
Enable Advanced WildFire Inline ML