Palo Alto Networks Threat Vault

The Palo Alto Networks Threat Vault connector allows users to query and retrieve detailed threat intelligence data, enhancing security operations with actionable insights.

Palo Alto Networks Threat Vault is a comprehensive threat intelligence database that provides metadata for antivirus, anti-spyware, and file signatures. The connector enables Swimlane Turbine users to retrieve this valuable threat metadata, enhancing incident response and threat hunting capabilities within their security operations. By integrating with Threat Vault, users can automate the enrichment of security incidents, leverage detailed intelligence for better decision-making, and streamline their threat analysis processes without the need for complex coding.

Prerequisites

To effectively utilize the Palo Alto Networks Threat Vault connector, ensure you have the following:

API Key Authentication:

URL: The endpoint URL for the Threat Vault API.

API Key: A valid API key provided by Palo Alto Networks to authenticate requests.

Capabilities

This connector provides the following capabilities:

Get Threat Metadata

Notes

API DOCS: https://pan.dev/threat-vault/api/threats/

Configurations

Palo Alto Threat Vault API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
X-API-KEY	API key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get Threat Metadata

Retrieve metadata for antivirus, anti-spyware, or file signatures from Palo Alto Networks Threat Vault.

Endpoint

URL: service/v1/threats

Method: GET

Input

Argument Name	Type	Required	Description
parameters.id	string	Optional	Parameters for the Get Threat Metadata action
parameters.name	string	Optional	Parameters for the Get Threat Metadata action
parameters.cve	string	Optional	Parameters for the Get Threat Metadata action
parameters.vendor	string	Optional	Parameters for the Get Threat Metadata action
parameters.fromReleaseDate	string	Optional	Parameters for the Get Threat Metadata action
parameters.toReleaseDate	string	Optional	Parameters for the Get Threat Metadata action
parameters.fromReleaseVersion	string	Optional	Parameters for the Get Threat Metadata action
parameters.toReleaseVersion	string	Optional	Parameters for the Get Threat Metadata action
parameters.releaseDate	string	Optional	Parameters for the Get Threat Metadata action
parameters.releaseVersion	string	Optional	Parameters for the Get Threat Metadata action
parameters.type	string	Optional	Parameters for the Get Threat Metadata action
parameters.sha256	string	Optional	Parameters for the Get Threat Metadata action
parameters.md5	string	Optional	Parameters for the Get Threat Metadata action
parameters.limit	string	Optional	Parameters for the Get Threat Metadata action
parameters.offset	string	Optional	Parameters for the Get Threat Metadata action
normalise_output	boolean	Optional	Normalise the output data.

Input Example

{"parameters":{"id":"12345678-1234-1234-1234-123456789abc","name":"Example Name","cve":"string","vendor":"string","fromReleaseDate":"string","toReleaseDate":"string","fromReleaseVersion":"string","toReleaseVersion":"string","releaseDate":"string","releaseVersion":"string","type":"string","sha256":"string","md5":"string","limit":"string","offset":"string"},"normalise_output":true}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
count	number	Count value
data	array	Response data
data.fileformat	array	Response data
data.fileformat.file_name	string	Response data
data.fileformat.file	string	Response data
data.spyware	array	Response data
data.spyware.file_name	string	Response data
data.spyware.file	string	Response data
data.vulnerability	array	Response data
data.vulnerability.id	string	Response data
data.vulnerability.name	string	Response data
data.vulnerability.description	string	Response data
data.vulnerability.category	string	Response data
data.vulnerability.min_version	string	Response data
data.vulnerability.max_version	string	Response data
data.vulnerability.severity	string	Response data
data.vulnerability.default_action	string	Response data
data.vulnerability.cve	array	Response data
data.vulnerability.vendor	array	Response data
data.vulnerability.reference	array	Response data
data.vulnerability.status	string	Response data
data.vulnerability.details	object	Response data
data.vulnerability.ori_release_version	string	Response data

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":6,"data":[{}],"link":[{}],"message":"Successful","success":true}}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT