Palo Alto Networks Wildfire
Palo Alto Wildfire
The Palo Alto Networks Wildfire connector enables automated threat detection and analysis by providing tools to submit and retrieve file and URL data for security assessment.
Palo Alto Networks Wildfire is a cutting-edge threat analysis service that identifies and evaluates unknown threats. This connector enables Swimlane Turbine users to automate the submission and retrieval of file and URL data for analysis, providing detailed reports and verdicts on potential threats. By integrating with Wildfire, users can enhance their security posture with rapid, code-free analysis of suspicious files and URLs, directly within their security workflows. This empowers teams to quickly identify and respond to threats, minimizing the window of risk and improving overall cyber resilience.
Prerequisites
To effectively utilize the Palo Alto Networks Wildfire connector within Swimlane Turbine, ensure you have the following prerequisites:
- API Key Authentication with the following parameters:
- URL: The base endpoint URL for the Wildfire API services.
- API Key: Your unique key to authenticate requests to the Wildfire API.
Capabilities
The Palo Alto Wildfire connector has the following capabilities:
- Get File Report
- Get File Verdict
- Get a Sample
- Get URL Report
- Get URL Verdict
- Submit File URL
- Submit Local File
- Submit URLS
Configurations
API Key Authentication
Authenticates using an API Key
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
apikey | API key | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Get File Report
Retrieve detailed reports for files analyzed by Palo Alto Networks Wildfire using a specified data body.
Endpoint
- URL: publicapi/get/report
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
data_body | object | Required | Data Body |
data_body.hash | string | Required | MD5 or SHA-256 hash value of the sample |
Input Example
{"data_body":{"hash":"string"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
wildfire | object | Output field: wildfire |
wildfire.version | string | Output field: wildfire.version |
wildfire.file_info | object | Output field: wildfire.file_info |
wildfire.file_info.file_signer | string | Output field: wildfire.file_info.file_signer |
wildfire.file_info.malware | string | Output field: wildfire.file_info.malware |
wildfire.file_info.sha1 | object | Output field: wildfire.file_info.sha1 |
wildfire.file_info.filetype | string | Type of the resource |
wildfire.file_info.sha256 | string | Output field: wildfire.file_info.sha256 |
wildfire.file_info.md5 | string | Output field: wildfire.file_info.md5 |
wildfire.file_info.size | string | Output field: wildfire.file_info.size |
wildfire.task_info | object | Output field: wildfire.task_info |
wildfire.task_info.report | object | Output field: wildfire.task_info.report |
wildfire.task_info.report.version | string | Output field: wildfire.task_info.report.version |
wildfire.task_info.report.platform | string | Output field: wildfire.task_info.report.platform |
wildfire.task_info.report.software | string | Output field: wildfire.task_info.report.software |
wildfire.task_info.report.sha256 | string | Output field: wildfire.task_info.report.sha256 |
wildfire.task_info.report.md5 | string | Output field: wildfire.task_info.report.md5 |
wildfire.task_info.report.malware | string | Output field: wildfire.task_info.report.malware |
wildfire.task_info.report.summary | object | Output field: wildfire.task_info.report.summary |
Output Example
{"wildfire":{"version":"string","file_info":{"file_signer":"string","malware":"string","sha1":{},"filetype":"string","sha256":"string","md5":"string","size":"string"},"task_info":{"report":{}}}}
Get File Verdict
Retrieve the verdict for a file from Palo Alto Networks Wildfire using a data body input.
Endpoint
- URL: publicapi/get/verdict
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
data_body | object | Required | Data Body |
data_body.hash | string | Required | MD5 or SHA-256 hash value of the sample |
Input Example
{"data_body":{"hash":"string"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
wildfire | object | Output field: wildfire |
wildfire.get-verdict-info | object | Output field: wildfire.get-verdict-info |
wildfire.get-verdict-info.sha256 | string | Output field: wildfire.get-verdict-info.sha256 |
wildfire.get-verdict-info.verdict | string | Output field: wildfire.get-verdict-info.verdict |
wildfire.get-verdict-info.md5 | string | Output field: wildfire.get-verdict-info.md5 |
Output Example
{"wildfire":{"get-verdict-info":{"sha256":"string","verdict":"string","md5":"string"}}}
Get a Sample
Retrieve a specific malware sample from Palo Alto Networks Wildfire using the provided data body.
Endpoint
- URL: publicapi/get/sample
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
data_body | object | Required | Data Body |
data_body.hash | string | Required | MD5 or SHA-256 hash value of the sample |
Input Example
{"data_body":{"hash":"string"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
response_text | string | Output field: response_text |
Output Example
{"response_text":"string"}
Get URL Report
Retrieve detailed reports for URLs from Palo Alto Networks Wildfire using a specified data body.
Endpoint
- URL: publicapi/get/report
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
data_body | object | Required | Data Body |
data_body.url | string | Required | The URL of the web page |
Input Example
{"data_body":{"url":"https://example.com/api/resource"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
success | boolean | Whether the operation was successful |
result | object | Result of the operation |
result.analysis_time | string | Result of the operation |
result.report | string | Result of the operation |
result.url_type | string | URL endpoint for the request |
Output Example
{"success":true,"result":{"analysis_time":"string","report":"string","url_type":"string"}}
Get URL Verdict
Retrieve the verdict for a URL from Palo Alto Networks Wildfire, requiring a data body input.
Endpoint
- URL: publicapi/get/verdict
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
data_body | object | Required | Data Body |
data_body.url | string | Required | The URL of the web page |
Input Example
{"data_body":{"url":"https://example.com/api/resource"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
wildfire | object | Output field: wildfire |
wildfire.get-verdict-info | object | Output field: wildfire.get-verdict-info |
wildfire.get-verdict-info.url | string | URL endpoint for the request |
wildfire.get-verdict-info.verdict | string | Output field: wildfire.get-verdict-info.verdict |
wildfire.get-verdict-info.analysis_time | string | Time value |
wildfire.get-verdict-info.valid | string | Unique identifier |
Output Example
{"wildfire":{"get-verdict-info":{"url":"https://example.com/api/resource","verdict":"string","analysis_time":"string","valid":"string"}}}
Submit File URL
Submit a file URL to Palo Alto Networks Wildfire for remote file analysis and receive a report on potential threats.
Endpoint
- URL: publicapi/submit/url
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
data_body | object | Required | Data Body |
data_body.url | string | Required | Remote file URL path |
Input Example
{"data_body":{"url":"https://example.com/api/resource"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
wildfire | object | Output field: wildfire |
wildfire.upload-file-info | object | Output field: wildfire.upload-file-info |
wildfire.upload-file-info.url | string | URL endpoint for the request |
wildfire.upload-file-info.filetype | string | Type of the resource |
wildfire.upload-file-info.filename | object | Name of the resource |
wildfire.upload-file-info.sha256 | string | Output field: wildfire.upload-file-info.sha256 |
wildfire.upload-file-info.md5 | string | Output field: wildfire.upload-file-info.md5 |
wildfire.upload-file-info.size | string | Output field: wildfire.upload-file-info.size |
Output Example
{"wildfire":{"upload-file-info":{"url":"https://example.com/api/resource","filetype":"string","filename":{},"sha256":"string","md5":"string","size":"string"}}}
Submit Local File
Submit a local file to Palo Alto Networks Wildfire for malware analysis. Requires an attachment.
Endpoint
- URL: publicapi/submit/file
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
attachments | array | Required | File to be submitted |
attachments.file | string | Optional | Parameter for Submit Local File |
attachments.file_name | string | Optional | Name of the resource |
Input Example
{"attachments":[{"file":"string","file_name":"Example Name"}]}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
wildfire | object | Output field: wildfire |
wildfire.upload-file-info | object | Output field: wildfire.upload-file-info |
wildfire.upload-file-info.url | string | URL endpoint for the request |
wildfire.upload-file-info.filetype | string | Type of the resource |
wildfire.upload-file-info.filename | string | Name of the resource |
wildfire.upload-file-info.sha256 | string | Output field: wildfire.upload-file-info.sha256 |
wildfire.upload-file-info.md5 | string | Output field: wildfire.upload-file-info.md5 |
wildfire.upload-file-info.size | string | Output field: wildfire.upload-file-info.size |
Output Example
{"wildfire":{"upload-file-info":{"url":"https://example.com/api/resource","filetype":"string","filename":"Example Name","sha256":"string","md5":"string","size":"string"}}}
Submit URLS
Submit up to 1000 URLs for analysis to Palo Alto Networks Wildfire, requiring a data body input.
Endpoint
- URL: publicapi/submit/links
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
data_body | object | Required | Data Body |
data_body.urls | array | Required | List of URLs to submit |
Input Example
{"data_body":{"urls":["string"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
wildfire | object | Output field: wildfire |
wildfire.submit-link-info | array | Output field: wildfire.submit-link-info |
wildfire.submit-link-info.url | string | URL endpoint for the request |
wildfire.submit-link-info.sha256 | string | Output field: wildfire.submit-link-info.sha256 |
wildfire.submit-link-info.md5 | string | Output field: wildfire.submit-link-info.md5 |
Output Example
{"wildfire":{"submit-link-info":[{}]}}
Response Headers
Header | Description | Example |
|---|---|---|
Connection | HTTP response header: Connection | ο»Ώ |
Content-Length | The length of the response body in bytes | ο»Ώ |
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |
Server | Information about the software used by the origin server | ο»Ώ |
Transfer-Encoding | HTTP response header: Transfer-Encoding | ο»Ώ |
x-envoy-upstream-service-time | HTTP response header: x-envoy-upstream-service-time | ο»Ώ |