Create and manage Advanced malware sandbox security profiles

This page shows you how to create, view, update, and delete Advanced malware sandbox (WildFire) security profiles of the WILDFIRE_ANALYSIS type by using the Google Cloud console and the Google Cloud CLI.

WILDFIRE_ANALYSIS security profiles define file inspection rules, supported file categories, and inline cloud analysis options for advanced malware sandboxing. For more information about how security profiles work within policy groups, see the Security profile overview.

Before you begin

• You must enable the Network Security API in your project.
• Install the gcloud CLI if you want to run the gcloud command-line examples in this guide.

Roles

To get the permissions that you need to create, view, update, or delete security profiles, ask your administrator to grant you the necessary Identity and Access Management (IAM) roles on your organization or project. For more information about granting roles, see Manage access to projects, folders, and organizations.

To monitor long-running operations triggered by the tasks on this page, you also need the Compute Network User (roles/compute.networkUser) role or a custom role containing the following permissions:

• networksecurity.operations.get
• networksecurity.operations.list

Create an Advanced malware sandbox security profile

When you create an Advanced malware sandbox security profile, you can specify the name of the security profile as a string or as a unique URL identifier.

You can construct the unique URL identifier for the security profile in the following formats:

• Organization-scoped:

  organizations/ORGANIZATION_ID/locations/global/securityProfiles/SECURITY_PROFILE_NAME
  

• Project-scoped:

  projects/PROJECT_ID/locations/global/securityProfiles/SECURITY_PROFILE_NAME
  

When you use a unique URL identifier, it must contain the security profile name, the organization or project, and the location, which is always set to global. Using a unique URL identifier lets you reference the security profile in other resources, such as security profile groups, or run gcloud commands without specifying the organization, project, or location flags separately.

For more information about unique URL identifiers, see Security profile specifications.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles on your organization or project.

Permissions

• networksecurity.securityProfiles.create

Roles

• Compute Network Admin (roles/compute.networkAdmin)
• Security Profile Admin (roles/networksecurity.securityProfileAdmin) granted at the organization level for organization-level Advanced malware sandbox security profiles, and at either the project level or the organization level for project-level Advanced malware sandbox security profiles

Console

1. In the Google Cloud console, go to the Security profiles page.

   Go to Security profiles

2. In the project selector menu, select your organization or project.

3. Select the Security profiles tab.

4. Click Create profile.

5. Enter a name in the Name field.

   Don't include sensitive information such as personally identifiable information or security data in the security profile name.

6. Optional: Enter a description in the Description field.

7. To create a Cloud Next Generation Firewall Enterprise security profile, in the Purpose section, select Cloud NGFW Enterprise.

8. To create an Advanced malware sandbox security profile, in the Type section, select Advanced malware sandbox (WildFire).

9. To prevent the transfer of known malware, select the Hold for real-time signature look up checkbox.

10. Optional: To set the Advanced malware sandbox overrides, do one or both of the following:

    • In the Signature overrides section, do the following:

      1. Click Add signature by ID.

      2. Enter the signature ID for which you want to override actions.

         Note: The signature ID must be an integer between 0 and 4,294,967,295 inclusive.

      3. From the Override action list, select one of the following:

         • Default: the packet takes the predefined default action specific to that individual threat signature.
         • Allow: the packet matching the firewall policy rule allows the connection.

      4. Click Add signature.

    • In the Protocol overrides section, do the following:

      Note: By default, the override action for each protocol is set to default.
      1. Click  Edit for the Protocol that you want to override. For example, HTTP, SMTP, or FTP.
      2. From the Action list, select the action. For example, Alert, Allow, or Deny.
      3. From the Inline ML action list, select the action. For example, Alert, Allow, or Deny.
      4. Click Confirm.

11. Optional: In the Submission rules section, do the following:

    1. Click Create rule.
    2. For File types, select Any, or select Specific and choose the file types from the File types list.

    3. For Direction, do one of the following:

       • Upload and download: the firewall monitors traffic in both the upload and download directions for submission rules.
       • Upload: the firewall monitors only outgoing traffic (uploads) for files to submit.
       • Download: the firewall monitors only incoming traffic (downloads) for files to submit.

    4. Click Create.

12. Optional: In the Inline cloud analysis rules section, do the following:

    1. Click Create rule.
    2. For File types, select Any or PE.

    3. For Direction, do one of the following:

       • Upload and download: the firewall monitors traffic in both the upload and download directions for inline cloud analysis.
       • Download: the firewall monitors only incoming traffic (downloads) for inline cloud analysis.

    4. From the Action list, select one of the following:

       • Alert: the packet is allowed to communicate, but the firewall rule generates a threat_log entry sent to the consumer project.
       • Allow: the packet matching the firewall policy rule allows the connection.
       • Deny: the packet and all subsequent packets belonging to the same connection drop completely. The firewall rule also generates a threat_log entry.

    5. Click Create.

13. Optional: In the Inline ML configuration section, do the following:

    Note: By default, the Advanced malware sandbox inline ML configuration action for each file type is set to Disable.
    1. Click  Edit for the File type that you want to configure. For example, ELF, Shell, or Macho.
    2. From the Action list, select Alert, Enable, or Disable.
    3. Click Confirm.

14. Optional: In the Inline ML file exceptions section, do the following:

    1. Click Add exception.
    2. In the File name field, enter the filename that you want to exclude from Advanced malware sandbox inline machine learning (ML) analysis.
    3. In the Partial hash field, enter the ML partial hash of the file that you want to exclude from Advanced malware sandbox inline ML analysis.
    4. Click Create.

15. Click Create.

gcloud

1. To create an Advanced malware sandbox security profile, run the gcloud network-security security-profiles wildfire-analysis create command:

   gcloud network-security security-profiles wildfire-analysis create NAME \
       [--organization=ORGANIZATION_ID | --project=PROJECT_ID] \
       [--billing-project=BILLING_PROJECT_ID] \
       --location=LOCATION \
       [--description=DESCRIPTION]
   

   Replace the following:

   • NAME: the name of the Advanced malware sandbox security profile; you can specify the name as a string or as a unique URL identifier.

     Don't include sensitive information such as personally identifiable information or security data in the security profile name.

     If you use a unique URL identifier for NAME, you can omit LOCATION and ORGANIZATION_ID or PROJECT_ID.

   • ORGANIZATION_ID: the organization where the Advanced malware sandbox security profile is created. Use this flag for an organization-scoped profile. If you use a unique URL identifier for NAME, you can omit the ORGANIZATION_ID flag.

   • PROJECT_ID: the project ID where the Advanced malware sandbox security profile is created. Use this flag for a project-scoped profile. If you use a unique URL identifier for NAME, you can omit the PROJECT_ID flag.

   • BILLING_PROJECT_ID: the project ID to use for billing and quotas for organization-scoped operations.

   • LOCATION: the location of the Advanced malware sandbox security profile.

     Location is always set to global. If you use a unique URL identifier for NAME, you can omit the LOCATION flag.

   • DESCRIPTION: an optional description for the Advanced malware sandbox security profile.

2. Optional: To add and manage signature overrides, you can use one or more of the following options:

   • To add a protocol-level override to block HTTP or SMTP threats, run the gcloud network-security security-profiles wildfire-analysis add-override command:

   gcloud network-security security-profiles wildfire-analysis add-override NAME \
       [--organization=ORGANIZATION_ID | --project=PROJECT_ID] \
       [--billing-project=BILLING_PROJECT_ID] \
       --location=global \
       --wildfire=HTTP,SMTP \
       --action=DENY
   

   • To add an inline ML protocol override, run the gcloud network-security security-profiles wildfire-analysis add-override command:

   gcloud network-security security-profiles wildfire-analysis add-override NAME \
       [--organization=ORGANIZATION_ID | --project=PROJECT_ID] \
       [--billing-project=BILLING_PROJECT_ID] \
       --location=global \
       --wildfire-inline-ml=HTTP \
       --action=DENY
   

   • To add a threat ID override, run the gcloud network-security security-profiles wildfire-analysis add-override command:

   gcloud network-security security-profiles wildfire-analysis add-override NAME \
       [--organization=ORGANIZATION_ID | --project=PROJECT_ID] \
       [--billing-project=BILLING_PROJECT_ID] \
       --location=global \
       --threat-ids=599805 \
       --action=ALLOW
   

   Replace the following parameters based on your selection:

   • NAME: the name of the Advanced malware sandbox security profile.
   • ORGANIZATION_ID: the organization ID. Use this flag for an organization-scoped profile.
   • PROJECT_ID: the project ID. Use this flag for a project-scoped profile.
   • BILLING_PROJECT_ID: the project ID to use for billing and quotas for organization-scoped operations.
   • --wildfire: the protocols to override the action for. Must be one of: SMTP, SMB, POP3, IMAP, HTTP2, HTTP, FTP.
   • --wildfire-inline-ml: local inline ML threats protocol override option.
   • --threat-ids: threat signature IDs to override. Note that the action must be DEFAULT or ALLOW.
   • ACTION: action to apply. Must be one of: DEFAULT, ALLOW, DENY, or ALERT.

3. Optional: To configure submission rules, run the gcloud network-security security-profiles wildfire-analysis add-submission-rule command:

   gcloud network-security security-profiles wildfire-analysis add-submission-rule NAME \
       [--organization=ORGANIZATION_ID | --project=PROJECT_ID] \
       [--billing-project=BILLING_PROJECT_ID] \
       --location=LOCATION \
       --file-types=FILE_TYPE1,FILE_TYPE2,... \
       --direction=DIRECTION
   

   Replace the following:

   • NAME: the name of the Advanced malware sandbox security profile.

   • ORGANIZATION_ID: the organization where the Advanced malware sandbox security profile is created. Use this flag for an organization-scoped profile. If you use a unique URL identifier for NAME, you can omit the ORGANIZATION_ID flag.

   • PROJECT_ID: the project ID where the Advanced malware sandbox security profile is created. Use this flag for a project-scoped profile. If you use a unique URL identifier for NAME, you can omit the PROJECT_ID flag.

   • BILLING_PROJECT_ID: the project ID to use for billing and quotas for organization-scoped operations.

   • LOCATION: the location of the Advanced malware sandbox security profile.

     Location is always set to global. If you use a unique URL identifier for NAME, you can omit the LOCATION flag.

   • FILE_TYPE1,FILE_TYPE2: types of files that will be submitted to Advanced malware sandbox for analysis. File type must be one of: ANY_FILE, APK, ARCHIVE, EMAIL_LINK, FLASH, JAR, LINUX, MS_OFFICE, PDF, PE, SCRIPT. Note that if ANY_FILE is specified, no other types should be specified.

   • DIRECTION: direction of traffic that will be checked for files to submit to Advanced malware sandbox. Direction must be one of: UPLOAD, DOWNLOAD, BOTH.

4. Optional: To configure inline cloud analysis rules, run the gcloud network-security security-profiles wildfire-analysis add-inline-cloud-analysis-rule command:

   gcloud network-security security-profiles wildfire-analysis add-inline-cloud-analysis-rule NAME \
       [--organization=ORGANIZATION_ID | --project=PROJECT_ID] \
       [--billing-project=BILLING_PROJECT_ID] \
       --location=LOCATION \
       --file-types=FILE_TYPE1,FILE_TYPE2,... \
       --direction=DIRECTION \
       --action=ACTION
   

   Replace the following:

   • NAME: the name of the Advanced malware sandbox security profile.

   • ORGANIZATION_ID: the organization where the Advanced malware sandbox security profile is created. Use this flag for an organization-scoped profile. If you use a unique URL identifier for NAME, you can omit the ORGANIZATION_ID flag.

   • PROJECT_ID: the project ID where the Advanced malware sandbox security profile is created. Use this flag for a project-scoped profile. If you use a unique URL identifier for NAME, you can omit the PROJECT_ID flag.

   • BILLING_PROJECT_ID: the project ID to use for billing and quotas for organization-scoped operations.

   • LOCATION: the location of the Advanced malware sandbox security profile.

     Location is always set to global. If you use a unique URL identifier for NAME, you can omit the LOCATION flag.

   • FILE_TYPE1,FILE_TYPE2: types of files that will be submitted to Advanced malware sandbox for analysis. FILE_TYPE must be one of: ANY_FILE, PE. Note that if ANY_FILE is specified, no other types should be specified.

   • DIRECTION: direction of traffic that will be checked for files to submit to Advanced malware sandbox. Direction must be one of: DOWNLOAD, BOTH.

   • ACTION: action to take when a threat is detected by Advanced malware sandbox inline cloud analysis. Action must be one of: ALLOW, ALERT, DENY.

5. Optional: To add inline ML file exceptions, run the gcloud network-security security-profiles wildfire-analysis add-inline-ml-exception command:

   gcloud network-security security-profiles wildfire-analysis add-inline-ml-exception NAME \
       [--organization=ORGANIZATION_ID | --project=PROJECT_ID] \
       [--billing-project=BILLING_PROJECT_ID] \
       --location=LOCATION \
       --partial-hash=PARTIAL_HASH \
       [--filename=FILENAME]
   

   Replace the following:

   • NAME: the name of the Advanced malware sandbox security profile.

   • ORGANIZATION_ID: the organization where the Advanced malware sandbox security profile is created. Use this flag for an organization-scoped profile. If you use a unique URL identifier for NAME, you can omit the ORGANIZATION_ID flag.

   • PROJECT_ID: the project ID where the Advanced malware sandbox security profile is created. Use this flag for a project-scoped profile. If you use a unique URL identifier for NAME, you can omit the PROJECT_ID flag.

   • BILLING_PROJECT_ID: the project ID to use for billing and quotas for organization-scoped operations.

   • LOCATION: the location of the Advanced malware sandbox security profile.

     Location is always set to global. If you use a unique URL identifier for NAME, you can omit the LOCATION flag.

   • PARTIAL_HASH: the ML partial SHA-256 hash of the file (up to 31 characters).

   • FILENAME: an optional filename of the file to exclude.

List Advanced malware sandbox security profiles

You can list all the Advanced malware sandbox security profiles in an organization or a project.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles on your organization or project.

Permissions

• networksecurity.securityProfiles.list

Roles

• Compute Network Admin (roles/compute.networkAdmin)
• Compute Network User (roles/compute.networkUser)
• Compute Network Viewer (roles/compute.networkViewer)
• Security Profile Admin (roles/networksecurity.securityProfileAdmin) granted at the organization level for organization-level Advanced malware sandbox security profiles, and at either the project level or the organization level for project-level Advanced malware sandbox security profiles
• Security Profile Viewer (roles/networksecurity.securityProfileViewer) granted at the organization level for organization-level Advanced malware sandbox security profiles, and at either the project level or the organization level for project-level Advanced malware sandbox security profiles

Console

1. In the Google Cloud console, go to the Security profiles page.

   Go to Security profiles

2. In the project selector menu, select your organization or project.

3. Select the Security profiles tab. The tab shows a list of configured security profiles.

4. To filter security profiles by profile type, enter Profile type and then select Advanced malware sandbox (WildFire) in the Filter search box.

gcloud

To list all the Advanced malware sandbox security profiles, use the gcloud network-security security-profiles wildfire-analysis list command:

gcloud network-security security-profiles wildfire-analysis list \
    [--organization ORGANIZATION_ID | --project PROJECT_ID] \
    --location LOCATION

Replace the following:

• ORGANIZATION_ID: the organization where the Advanced malware sandbox security profiles are created. Use this flag to list organization-scoped profiles.

• PROJECT_ID: the project ID where the Advanced malware sandbox security profiles are created. Use this flag to list project-scoped profiles.

• LOCATION: the location of the Advanced malware sandbox security profiles. Location is always set to global.

Update an Advanced malware sandbox security profile

You can update the details of a specific Advanced malware sandbox security profile in an organization or a project.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles on your organization or project.

Permissions

• networksecurity.securityProfiles.update

Roles

• Compute Network Admin (roles/compute.networkAdmin)
• Security Profile Admin (roles/networksecurity.securityProfileAdmin) granted at the organization level for organization-level Advanced malware sandbox security profiles, and at either the project level or the organization level for project-level Advanced malware sandbox security profiles

Console

1. In the Google Cloud console, go to the Security profiles page.

   Go to Security profiles

2. In the project selector menu, select your organization or project.

3. Select the Security profiles tab. The tab shows a list of configured security profiles.

4. Click a security profile of type Advanced malware sandbox (WildFire) to view the profile details.

5. Click Edit.

gcloud

To update the details of an Advanced malware sandbox security profile, use the gcloud network-security security-profiles wildfire-analysis update command:

gcloud network-security security-profiles wildfire-analysis update NAME \
    [--organization ORGANIZATION_ID | --project PROJECT_ID] \
    [--billing-project BILLING_PROJECT_ID] \
    --location LOCATION \
    [--[no-]wildfire-realtime-lookup |
     --[no-]analyze-windows-executables |
     --[no-]analyze-powershell-script-1 |
     --[no-]analyze-powershell-script-2 |
     --[no-]analyze-elf |
     --[no-]analyze-ms-office |
     --[no-]analyze-shell |
     --[no-]analyze-ooxml |
     --[no-]analyze-macho]

Note: You must specify one of the following flags in a single command: --wildfire-realtime-lookup, --analyze-windows-executables, --analyze-powershell-script-1, --analyze-powershell-script-2, --analyze-elf, --analyze-ms-office, --analyze-shell, --analyze-ooxml, or --analyze-macho.

Replace the following:

• NAME: the name of the security profile of type WILDFIRE_ANALYSIS that you want to update.

• ORGANIZATION_ID: the organization where the Advanced malware sandbox security profile is created. Use this flag for an organization-scoped profile. If you use a unique URL identifier for the NAME flag, you can omit the ORGANIZATION_ID flag.

• PROJECT_ID: the project ID where the Advanced malware sandbox security profile is created. Use this flag for a project-scoped profile. If you use a unique URL identifier for the NAME flag, you can omit the PROJECT_ID flag.

• BILLING_PROJECT_ID: the project ID to use for billing and quotas for organization-scoped operations.

• LOCATION: the location of the Advanced malware sandbox security profile. Location is always set to global. If you use a unique URL identifier for the NAME flag, you can omit the LOCATION flag.

View an Advanced malware sandbox security profile

You can view a specific Advanced malware sandbox security profile in an organization or a project.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles on your organization or project.

Permissions

• networksecurity.securityProfiles.get

Roles

• Compute Network Admin (roles/compute.networkAdmin)
• Compute Network User (roles/compute.networkUser)
• Compute Network Viewer (roles/compute.networkViewer)
• Security Profile Admin (roles/networksecurity.securityProfileAdmin) granted at the organization level for organization-level Advanced malware sandbox security profiles, and at either the project level or the organization level for project-level Advanced malware sandbox security profiles
• Security Profile Viewer (roles/networksecurity.securityProfileViewer) granted at the organization level for organization-level Advanced malware sandbox security profiles, and at either the project level or the organization level for project-level Advanced malware sandbox security profiles

Console

1. In the Google Cloud console, go to the Security profiles page.

   Go to Security profiles

2. In the project selector menu, select your organization or project.

3. Select the Security profiles tab. The tab shows a list of configured security profiles.

4. Click a security profile of type Advanced malware sandbox (WildFire) to view the profile details.

gcloud

To view the details of an Advanced malware sandbox security profile, use the gcloud network-security security-profiles wildfire-analysis describe command:

gcloud network-security security-profiles wildfire-analysis describe NAME \
    [--organization ORGANIZATION_ID | --project PROJECT_ID] \
    --location LOCATION

Replace the following:

• NAME: the name of the security profile of type WILDFIRE_ANALYSIS that you want to describe; you can specify the name as a string or as a unique URL identifier.

• ORGANIZATION_ID: the organization ID where the Advanced malware sandbox security profile exists. If you use a unique URL identifier for the NAME flag, you can omit the ORGANIZATION_ID flag.

• PROJECT_ID: the project ID where the Advanced malware sandbox security profile exists. If you use a unique URL identifier for the NAME flag, you can omit the PROJECT_ID flag.

• LOCATION: the location of the Advanced malware sandbox security profile. Location is always set to global. If you use a unique URL identifier for the NAME flag, you can omit the LOCATION flag.

For example, to describe a security profile named MySecurityProfile by using its unique URL identifier, run the following command:

• Organization-scoped:

gcloud network-security security-profiles wildfire-analysis describe organizations/123456789012/locations/global/securityProfiles/MySecurityProfile

• Project-scoped:

gcloud network-security security-profiles wildfire-analysis describe projects/my-project/locations/global/securityProfiles/MySecurityProfile

Delete an Advanced malware sandbox security profile

You can delete an Advanced malware sandbox security profile by specifying its name, location, and organization or project. However, if a security profile group references the Advanced malware sandbox security profile, you must remove the security profile from the security profile group before you can delete it.

Permissions required for this task

To perform this task, you must have been granted the following permissions or one of the following IAM roles on your organization or project.

Permissions

• networksecurity.securityProfiles.delete

Roles

• Compute Network Admin (roles/compute.networkAdmin)
• Security Profile Admin (roles/networksecurity.securityProfileAdmin) granted at the organization level for organization-level Advanced malware sandbox security profiles, and at either the project level or the organization level for project-level Advanced malware sandbox security profiles

Console

1. In the Google Cloud console, go to the Security profiles page.

   Go to Security profiles

2. In the project selector menu, select your organization or project.

3. Select the Security profiles tab. The tab shows a list of configured security profiles.

4. Select the Advanced malware sandbox security profile that you want to delete, and then click Delete.

5. Click Delete again to confirm.

gcloud

To delete an Advanced malware sandbox security profile, use the gcloud network-security security-profiles wildfire-analysis delete command:

gcloud network-security security-profiles wildfire-analysis delete NAME \
    [--organization ORGANIZATION_ID | --project PROJECT_ID] \
    [--billing-project BILLING_PROJECT_ID] \
    --location LOCATION

Replace the following:

• NAME: the name of the Advanced malware sandbox security profile that you want to delete; you can specify the name as a string or as a unique URL identifier.

• ORGANIZATION_ID: the organization where the Advanced malware sandbox security profile is created. Use this flag for an organization-scoped profile. If you use a unique URL identifier for the NAME flag, you can omit the ORGANIZATION_ID flag.

• PROJECT_ID: the project ID where the Advanced malware sandbox security profile is created. Use this flag for a project-scoped profile. If you use a unique URL identifier for the NAME flag, you can omit the PROJECT_ID flag.

• BILLING_PROJECT_ID: the project ID to use for billing and quotas for organization-scoped operations.

• LOCATION: the location of the Advanced malware sandbox security profile. Location is always set to global. If you use a unique URL identifier for the NAME flag, you can omit the LOCATION flag.

Delete a signature override

gcloud

To delete a signature override or exception, run the gcloud network-security security-profiles wildfire-analysis delete-override command:

gcloud network-security security-profiles wildfire-analysis delete-override NAME \
    [--organization=ORGANIZATION_ID | --project=PROJECT_ID] \
    [--billing-project=BILLING_PROJECT_ID] \
    --location=global \
    [--threat-ids=THREAT_IDS | --wildfire=PROTOCOLS | --wildfire-inline-ml=PROTOCOLS]

Replace the following:

• NAME: the name of the Advanced malware sandbox security profile.

• ORGANIZATION_ID: the organization where the Advanced malware sandbox security profile is created. Use this flag for an organization-scoped profile. If you use a unique URL identifier for the NAME flag, you can omit the ORGANIZATION_ID flag.

• PROJECT_ID: the project ID where the Advanced malware sandbox security profile is created. Use this flag for a project-scoped profile. If you use a unique URL identifier for the NAME flag, you can omit the PROJECT_ID flag.

• BILLING_PROJECT_ID: the project ID to use for billing and quotas for organization-scoped operations.

• THREAT_IDS: a comma-separated list of threat signature IDs to remove overrides for.

• PROTOCOLS: a comma-separated list of protocols (SMTP, SMB, POP3, IMAP, HTTP2, HTTP, FTP) to remove protocol or inline ML overrides for.

Delete a submission rule

gcloud

To delete a submission rule, run the gcloud network-security security-profiles wildfire-analysis delete-submission-rule command:

gcloud network-security security-profiles wildfire-analysis delete-submission-rule NAME \
    [--organization=ORGANIZATION_ID | --project=PROJECT_ID] \
    [--billing-project=BILLING_PROJECT_ID] \
    --location=global \
    --file-types=FILE_TYPE1,FILE_TYPE2,... \
    --direction=DIRECTION

Replace the following:

• NAME: the name of the Advanced malware sandbox security profile.

• ORGANIZATION_ID: the organization where the Advanced malware sandbox security profile is created. Use this flag for an organization-scoped profile. If you use a unique URL identifier for the NAME flag, you can omit the ORGANIZATION_ID flag.

• PROJECT_ID: the project ID where the Advanced malware sandbox security profile is created. Use this flag for a project-scoped profile. If you use a unique URL identifier for the NAME flag, you can omit the PROJECT_ID flag.

• BILLING_PROJECT_ID: the project ID to use for billing and quotas for organization-scoped operations.

• FILE_TYPE1,FILE_TYPE2: types of files configured in the submission rule (ANY_FILE, APK, ARCHIVE, EMAIL_LINK, FLASH, JAR, LINUX, MS_OFFICE, PDF, PE, SCRIPT).

• DIRECTION: direction of traffic configured in the submission rule (UPLOAD, DOWNLOAD, BOTH).

Delete an inline cloud analysis rule

gcloud

To delete an inline cloud analysis rule, run the gcloud network-security security-profiles wildfire-analysis delete-inline-cloud-analysis-rule command:

gcloud network-security security-profiles wildfire-analysis delete-inline-cloud-analysis-rule NAME \
    [--organization=ORGANIZATION_ID | --project=PROJECT_ID] \
    [--billing-project=BILLING_PROJECT_ID] \
    --location=global \
    --file-types=FILE_TYPE1,FILE_TYPE2,... \
    --direction=DIRECTION \
    --action=ACTION

Replace the following:

• NAME: the name of the Advanced malware sandbox security profile.

• ORGANIZATION_ID: the organization where the Advanced malware sandbox security profile is created. Use this flag for an organization-scoped profile. If you use a unique URL identifier for the NAME flag, you can omit the ORGANIZATION_ID flag.

• PROJECT_ID: the project ID where the Advanced malware sandbox security profile is created. Use this flag for a project-scoped profile. If you use a unique URL identifier for the NAME flag, you can omit the PROJECT_ID flag.

• BILLING_PROJECT_ID: the project ID to use for billing and quotas for organization-scoped operations.

• FILE_TYPE1,FILE_TYPE2: types of files configured in the inline cloud analysis rule. FILE_TYPE must be one of: ANY_FILE, PE.

• DIRECTION: direction of traffic configured in the inline cloud analysis rule. Direction must be one of: DOWNLOAD, BOTH.

• ACTION: action configured in the inline cloud analysis rule. Action must be one of: ALLOW, ALERT, DENY.

Delete an inline ML exception

gcloud

To delete an inline ML exception, run the gcloud network-security security-profiles wildfire-analysis delete-inline-ml-exception command:

gcloud network-security security-profiles wildfire-analysis delete-inline-ml-exception NAME \
    [--organization=ORGANIZATION_ID | --project=PROJECT_ID] \
    [--billing-project=BILLING_PROJECT_ID] \
    --location=global \
    --partial-hash=PARTIAL_HASH \
    [--filename=FILENAME]

Replace the following:

• NAME: the name of the Advanced malware sandbox security profile.

• ORGANIZATION_ID: the organization where the Advanced malware sandbox security profile is created. Use this flag for an organization-scoped profile. If you use a unique URL identifier for NAME, you can omit the ORGANIZATION_ID flag.

• PROJECT_ID: the project ID where the Advanced malware sandbox security profile is created. Use this flag for a project-scoped profile. If you use a unique URL identifier for NAME, you can omit the PROJECT_ID flag.

• BILLING_PROJECT_ID: the project ID to use for billing and quotas for organization-scoped operations.

• PARTIAL_HASH: the ML partial SHA-256 hash of the file (up to 31 characters).

• FILENAME: the filename of the file to exclude. Required if you specified --filename when creating the exception.

What's next

• Create and manage security profile groups
• Create and manage firewall endpoints
• Advanced malware sandbox overview