--- title: Palo Alto Networks Threat Vault slug: connectors/palo-alto-networks-threat-vault docTags: createdAt: 2026-06-09T16:29:47.809Z --- The Palo Alto Networks Threat Vault connector allows users to query and retrieve detailed threat intelligence data, enhancing security operations with actionable insights. Palo Alto Networks Threat Vault is a comprehensive threat intelligence database that provides metadata for antivirus, anti-spyware, and file signatures. The connector enables Swimlane Turbine users to retrieve this valuable threat metadata, enhancing incident response and threat hunting capabilities within their security operations. By integrating with Threat Vault, users can automate the enrichment of security incidents, leverage detailed intelligence for better decision-making, and streamline their threat analysis processes without the need for complex coding. ## Prerequisites To effectively utilize the Palo Alto Networks Threat Vault connector, ensure you have the following: - API Key Authentication: - URL: The endpoint URL for the Threat Vault API. - API Key: A valid API key provided by Palo Alto Networks to authenticate requests. ## Capabilities This connector provides the following capabilities: - Get Threat Metadata ## Notes API DOCS: [https://pan.dev/threat-vault/api/threats/](https://pan.dev/threat-vault/api/threats/) # Configurations ## Palo Alto Threat Vault API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | X-API-KEY | API key | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get Threat Metadata Retrieve metadata for antivirus, anti-spyware, or file signatures from Palo Alto Networks Threat Vault. ### Endpoint - **URL:** `service/v1/threats` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | --------------------------------------------- | | `parameters.id` | string | Optional | Parameters for the Get Threat Metadata action | | `parameters.name` | string | Optional | Parameters for the Get Threat Metadata action | | `parameters.cve` | string | Optional | Parameters for the Get Threat Metadata action | | `parameters.vendor` | string | Optional | Parameters for the Get Threat Metadata action | | `parameters.fromReleaseDate` | string | Optional | Parameters for the Get Threat Metadata action | | `parameters.toReleaseDate` | string | Optional | Parameters for the Get Threat Metadata action | | `parameters.fromReleaseVersion` | string | Optional | Parameters for the Get Threat Metadata action | | `parameters.toReleaseVersion` | string | Optional | Parameters for the Get Threat Metadata action | | `parameters.releaseDate` | string | Optional | Parameters for the Get Threat Metadata action | | `parameters.releaseVersion` | string | Optional | Parameters for the Get Threat Metadata action | | `parameters.type` | string | Optional | Parameters for the Get Threat Metadata action | | `parameters.sha256` | string | Optional | Parameters for the Get Threat Metadata action | | `parameters.md5` | string | Optional | Parameters for the Get Threat Metadata action | | `parameters.limit` | string | Optional | Parameters for the Get Threat Metadata action | | `parameters.offset` | string | Optional | Parameters for the Get Threat Metadata action | | `normalise_output` | boolean | Optional | Normalise the output data. | ### Input Example `{"parameters":{"id":"12345678-1234-1234-1234-123456789abc","name":"Example Name","cve":"string","vendor":"string","fromReleaseDate":"string","toReleaseDate":"string","fromReleaseVersion":"string","toReleaseVersion":"string","releaseDate":"string","releaseVersion":"string","type":"string","sha256":"string","md5":"string","limit":"string","offset":"string"},"normalise_output":true}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `count` | number | Count value | | `data` | array | Response data | | `data.fileformat` | array | Response data | | `data.fileformat.file_name` | string | Response data | | `data.fileformat.file` | string | Response data | | `data.spyware` | array | Response data | | `data.spyware.file_name` | string | Response data | | `data.spyware.file` | string | Response data | | `data.vulnerability` | array | Response data | | `data.vulnerability.id` | string | Response data | | `data.vulnerability.name` | string | Response data | | `data.vulnerability.description` | string | Response data | | `data.vulnerability.category` | string | Response data | | `data.vulnerability.min_version` | string | Response data | | `data.vulnerability.max_version` | string | Response data | | `data.vulnerability.severity` | string | Response data | | `data.vulnerability.default_action` | string | Response data | | `data.vulnerability.cve` | array | Response data | | `data.vulnerability.vendor` | array | Response data | | `data.vulnerability.reference` | array | Response data | | `data.vulnerability.status` | string | Response data | | `data.vulnerability.details` | object | Response data | | `data.vulnerability.ori_release_version` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":6,"data":[{}],"link":[{}],"message":"Successful","success":true}}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |