> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-files/review-wildfire-analysis-details.md). # Review WildFire analysis details For each file, Cortex XDR receives a file verdict and the [WildFire Analysis Report](https://docs.paloaltonetworks.com/wildfire/9-1/wildfire-admin/monitor-wildfire-activity/wildfire-analysis-reportsclose-up). This report contains detailed sample information and behavior analysis in different sandbox environments, leading to the WildFire verdict. You can use the report to assess whether the file poses a real threat on an endpoint. The details in the WildFire analysis report for each event vary depending on the file type and the behavior of the file.
Drill down into WildFire analysis details WildFire analysis details are available for files that receive a WildFire verdict. The Analysis Reports section includes the WildFire analysis for each testing environment based on the observed behavior for the file. 1. Open the WildFire report. If you are analyzing an incident in the incident detail view you can see artifact details on the **Key Assets & Artifacts** tab. Under **Artifacts**, identify a file with a WildFire verdict and click **Wildfire Analysis Report** (![WF-report-icon.png](/files/QuyWQE0g4oeEabMWBEms)). If you are analyzing an alert, hover over the alert and **Investigate**. You can open (![WF-report-icon.png](/files/QuyWQE0g4oeEabMWBEms)) the WildFire report of any file included in the alert Causality Chain.

Note

Cortex XDR displays the preview of WildFire reports that were generated within the last couple of years. To view a report that was generated more than two years ago, you can download the report.

2. Analyze the WildFire report. On the left side of the report, you can see all the environments in which the Wildfire service tested the sample. If a file is low risk and WildFire can easily determine that it is safe, only static analysis is performed on the file. Select the testing environment to review the summary and additional details. To learn more about the behavior summary, see [WildFire Analysis Reports—Close Up](https://docs.paloaltonetworks.com/wildfire/9-1/wildfire-admin/monitor-wildfire-activity/wildfire-analysis-reportsclose-up). 3. (Optional) Download the WildFire report. If you want to download the WildFire report as it was generated by the WildFire service, click (![WF-report-download-icon.png](/files/3xb0OUJLUoOkw7WKBste)). The report is downloaded in PDF format.
Report an incorrect verdict to Palo Alto Networks If you know the WildFire verdict is incorrect, for example, WildFire assigned a Malware verdict to a file you wrote and know to be Benign, you can report an incorrect verdict to Cortex XDR to request the verdict change. 1. Open the WildFire report and verify the verdict that you are reporting. 2. Click **Report Verdict as Incorrect** (![WF-report-verdict-as-incorrect-icon.png](/files/gH5H5nKK5DBqwVSgpowH)). 3. Under **Suggested Verdict**, suggest a new verdict. 4. Under **Comment**, enter any details that can help us to better understand why you disagree with the verdict. 5. Under **Email**, verify your email address. 6. Click **OK**. The threat team will perform further analysis of the sample to determine whether it should be reclassified. If a malware sample is determined to be safe, the signature for the file is disabled in an upcoming antivirus signature update. If a benign file is determined to be malicious, a new signature is generated. After the investigation is complete, you will receive an email describing the action that was taken.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-files/review-wildfire-analysis-details.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.