PAN WildFire or ML-Virus Malicious File Verdict
This rule monitors Palo Alto Networks firewalls for files identified as malicious by the WildFire or ML-based threat detection engines. It filters out known allowed file hashes and aggregates events to provide a high-confidence alert. The rule categorizes threats based on the verdict ('malicious', 'malware', 'phishing', 'suspicious', 'c2') and distinguishes whether the threat was blocked or delivered to the network, providing context for incident response.
Microsoft Sentinel (KQL)
