Palo Alto Networks WildFire is a firewall that analyzes network traffic, including applications, using the SHA-256 hash calculator. If you use Palo Alto Networks WildFire as a firewall, it integrates with Workspace ONE UEM using scheduled communications with the SHA-256 hash calculator to transfer data.

The integration includes these schedulers and communication interactions.

  • Workspace ONE UEM sends application hashes on schedule using the Workspace ONE Intelligent Hub for Android on devices and the Workspace ONE UEM Integration Service.

  • WildFire responds with three verdicts: malware, grayware, and benign.

  • Workspace ONE UEM creates two blacklisted app groups using malware and grayware verdicts. It records benign verdicts and does not resend hashes for benign applications.

  • Workspace ONE UEM calls to WildFire are synchronous and responses are immediate.

  • Integration uses port 443 for communication.


Integrating with other products offers convenience and flexibility to help manage mobile deployments. However, functionality is not guaranteed and it depends upon the proper functioning of third-party solutions.