---
title: Palo Alto Networks Wildfire
slug: connectors/palo-alto-networks-wildfire
docTags: 
createdAt: 2026-06-09T16:30:15.498Z
---

## Palo Alto Wildfire

The Palo Alto Networks Wildfire connector enables automated threat detection and analysis by providing tools to submit and retrieve file and URL data for security assessment.

Palo Alto Networks Wildfire is a cutting-edge threat analysis service that identifies and evaluates unknown threats. This connector enables Swimlane Turbine users to automate the submission and retrieval of file and URL data for analysis, providing detailed reports and verdicts on potential threats. By integrating with Wildfire, users can enhance their security posture with rapid, code-free analysis of suspicious files and URLs, directly within their security workflows. This empowers teams to quickly identify and respond to threats, minimizing the window of risk and improving overall cyber resilience.

## Prerequisites

To effectively utilize the Palo Alto Networks Wildfire connector within Swimlane Turbine, ensure you have the following prerequisites:

- API Key Authentication with the following parameters:
  - URL: The base endpoint URL for the Wildfire API services.
  - API Key: Your unique key to authenticate requests to the Wildfire API.

## Capabilities

The Palo Alto Wildfire connector has the following capabilities:

- Get File Report
- Get File Verdict
- Get a Sample
- Get URL Report
- Get URL Verdict
- Submit File URL
- Submit Local File
- Submit URLS

# Configurations

## API Key Authentication

Authenticates using an API Key

### Configuration Parameters

| **Parameter** | **Description**                    | **Type** | **Required** |
| ------------- | ---------------------------------- | -------- | ------------ |
| url           | A URL to the target host.          | string   | Required     |
| apikey        | API key                            | string   | Required     |
| verify\_ssl   | Verify SSL certificate             | boolean  | Optional     |
| http\_proxy   | A proxy to route requests through. | string   | Optional     |

# Actions

## Get File Report

Retrieve detailed reports for files analyzed by Palo Alto Networks Wildfire using a specified data body.

### Endpoint

- **URL:** `publicapi/get/report`
- **Method:** `POST`

### Input

| **Argument Name** | **Type** | **Required** | **Description**                         |
| ----------------- | -------- | ------------ | --------------------------------------- |
| `data_body`       | object   | Required     | Data Body                               |
| `data_body.hash`  | string   | Required     | MD5 or SHA-256 hash value of the sample |

### Input Example

`{"data_body":{"hash":"string"}}`

### Output

| **Parameter**                        | **Type** | **Description**                                   |
| ------------------------------------ | -------- | ------------------------------------------------- |
| `status_code`                        | number   | HTTP status code of the response                  |
| `reason`                             | string   | Response reason phrase                            |
| `wildfire`                           | object   | Output field: wildfire                            |
| `wildfire.version`                   | string   | Output field: wildfire.version                    |
| `wildfire.file_info`                 | object   | Output field: wildfire.file\_info                 |
| `wildfire.file_info.file_signer`     | string   | Output field: wildfire.file\_info.file\_signer    |
| `wildfire.file_info.malware`         | string   | Output field: wildfire.file\_info.malware         |
| `wildfire.file_info.sha1`            | object   | Output field: wildfire.file\_info.sha1            |
| `wildfire.file_info.filetype`        | string   | Type of the resource                              |
| `wildfire.file_info.sha256`          | string   | Output field: wildfire.file\_info.sha256          |
| `wildfire.file_info.md5`             | string   | Output field: wildfire.file\_info.md5             |
| `wildfire.file_info.size`            | string   | Output field: wildfire.file\_info.size            |
| `wildfire.task_info`                 | object   | Output field: wildfire.task\_info                 |
| `wildfire.task_info.report`          | object   | Output field: wildfire.task\_info.report          |
| `wildfire.task_info.report.version`  | string   | Output field: wildfire.task\_info.report.version  |
| `wildfire.task_info.report.platform` | string   | Output field: wildfire.task\_info.report.platform |
| `wildfire.task_info.report.software` | string   | Output field: wildfire.task\_info.report.software |
| `wildfire.task_info.report.sha256`   | string   | Output field: wildfire.task\_info.report.sha256   |
| `wildfire.task_info.report.md5`      | string   | Output field: wildfire.task\_info.report.md5      |
| `wildfire.task_info.report.malware`  | string   | Output field: wildfire.task\_info.report.malware  |
| `wildfire.task_info.report.summary`  | object   | Output field: wildfire.task\_info.report.summary  |

### Output Example

`{"wildfire":{"version":"string","file_info":{"file_signer":"string","malware":"string","sha1":{},"filetype":"string","sha256":"string","md5":"string","size":"string"},"task_info":{"report":{}}}}`

## Get File Verdict

Retrieve the verdict for a file from Palo Alto Networks Wildfire using a data body input.

### Endpoint

- **URL:** `publicapi/get/verdict`
- **Method:** `POST`

### Input

| **Argument Name** | **Type** | **Required** | **Description**                         |
| ----------------- | -------- | ------------ | --------------------------------------- |
| `data_body`       | object   | Required     | Data Body                               |
| `data_body.hash`  | string   | Required     | MD5 or SHA-256 hash value of the sample |

### Input Example

`{"data_body":{"hash":"string"}}`

### Output

| **Parameter**                       | **Type** | **Description**                                 |
| ----------------------------------- | -------- | ----------------------------------------------- |
| `status_code`                       | number   | HTTP status code of the response                |
| `reason`                            | string   | Response reason phrase                          |
| `wildfire`                          | object   | Output field: wildfire                          |
| `wildfire.get-verdict-info`         | object   | Output field: wildfire.get-verdict-info         |
| `wildfire.get-verdict-info.sha256`  | string   | Output field: wildfire.get-verdict-info.sha256  |
| `wildfire.get-verdict-info.verdict` | string   | Output field: wildfire.get-verdict-info.verdict |
| `wildfire.get-verdict-info.md5`     | string   | Output field: wildfire.get-verdict-info.md5     |

### Output Example

`{"wildfire":{"get-verdict-info":{"sha256":"string","verdict":"string","md5":"string"}}}`

## Get a Sample

Retrieve a specific malware sample from Palo Alto Networks Wildfire using the provided data body.

### Endpoint

- **URL:** `publicapi/get/sample`
- **Method:** `POST`

### Input

| **Argument Name** | **Type** | **Required** | **Description**                         |
| ----------------- | -------- | ------------ | --------------------------------------- |
| `data_body`       | object   | Required     | Data Body                               |
| `data_body.hash`  | string   | Required     | MD5 or SHA-256 hash value of the sample |

### Input Example

`{"data_body":{"hash":"string"}}`

### Output

| **Parameter**   | **Type** | **Description**                  |
| --------------- | -------- | -------------------------------- |
| `status_code`   | number   | HTTP status code of the response |
| `reason`        | string   | Response reason phrase           |
| `response_text` | string   | Output field: response\_text     |

### Output Example

`{"response_text":"string"}`

## Get URL Report

Retrieve detailed reports for URLs from Palo Alto Networks Wildfire using a specified data body.

### Endpoint

- **URL:** `publicapi/get/report`
- **Method:** `POST`

### Input

| **Argument Name** | **Type** | **Required** | **Description**         |
| ----------------- | -------- | ------------ | ----------------------- |
| `data_body`       | object   | Required     | Data Body               |
| `data_body.url`   | string   | Required     | The URL of the web page |

### Input Example

`{"data_body":{"url":"https://example.com/api/resource"}}`

### Output

| **Parameter**          | **Type** | **Description**                      |
| ---------------------- | -------- | ------------------------------------ |
| `status_code`          | number   | HTTP status code of the response     |
| `reason`               | string   | Response reason phrase               |
| `success`              | boolean  | Whether the operation was successful |
| `result`               | object   | Result of the operation              |
| `result.analysis_time` | string   | Result of the operation              |
| `result.report`        | string   | Result of the operation              |
| `result.url_type`      | string   | URL endpoint for the request         |

### Output Example

`{"success":true,"result":{"analysis_time":"string","report":"string","url_type":"string"}}`

## Get URL Verdict

Retrieve the verdict for a URL from Palo Alto Networks Wildfire, requiring a data body input.

### Endpoint

- **URL:** `publicapi/get/verdict`
- **Method:** `POST`

### Input

| **Argument Name** | **Type** | **Required** | **Description**         |
| ----------------- | -------- | ------------ | ----------------------- |
| `data_body`       | object   | Required     | Data Body               |
| `data_body.url`   | string   | Required     | The URL of the web page |

### Input Example

`{"data_body":{"url":"https://example.com/api/resource"}}`

### Output

| **Parameter**                             | **Type** | **Description**                                 |
| ----------------------------------------- | -------- | ----------------------------------------------- |
| `status_code`                             | number   | HTTP status code of the response                |
| `reason`                                  | string   | Response reason phrase                          |
| `wildfire`                                | object   | Output field: wildfire                          |
| `wildfire.get-verdict-info`               | object   | Output field: wildfire.get-verdict-info         |
| `wildfire.get-verdict-info.url`           | string   | URL endpoint for the request                    |
| `wildfire.get-verdict-info.verdict`       | string   | Output field: wildfire.get-verdict-info.verdict |
| `wildfire.get-verdict-info.analysis_time` | string   | Time value                                      |
| `wildfire.get-verdict-info.valid`         | string   | Unique identifier                               |

### Output Example

`{"wildfire":{"get-verdict-info":{"url":"https://example.com/api/resource","verdict":"string","analysis_time":"string","valid":"string"}}}`

## Submit File URL

Submit a file URL to Palo Alto Networks Wildfire for remote file analysis and receive a report on potential threats.

### Endpoint

- **URL:** `publicapi/submit/url`
- **Method:** `POST`

### Input

| **Argument Name** | **Type** | **Required** | **Description**      |
| ----------------- | -------- | ------------ | -------------------- |
| `data_body`       | object   | Required     | Data Body            |
| `data_body.url`   | string   | Required     | Remote file URL path |

### Input Example

`{"data_body":{"url":"https://example.com/api/resource"}}`

### Output

| **Parameter**                        | **Type** | **Description**                                |
| ------------------------------------ | -------- | ---------------------------------------------- |
| `status_code`                        | number   | HTTP status code of the response               |
| `reason`                             | string   | Response reason phrase                         |
| `wildfire`                           | object   | Output field: wildfire                         |
| `wildfire.upload-file-info`          | object   | Output field: wildfire.upload-file-info        |
| `wildfire.upload-file-info.url`      | string   | URL endpoint for the request                   |
| `wildfire.upload-file-info.filetype` | string   | Type of the resource                           |
| `wildfire.upload-file-info.filename` | object   | Name of the resource                           |
| `wildfire.upload-file-info.sha256`   | string   | Output field: wildfire.upload-file-info.sha256 |
| `wildfire.upload-file-info.md5`      | string   | Output field: wildfire.upload-file-info.md5    |
| `wildfire.upload-file-info.size`     | string   | Output field: wildfire.upload-file-info.size   |

### Output Example

`{"wildfire":{"upload-file-info":{"url":"https://example.com/api/resource","filetype":"string","filename":{},"sha256":"string","md5":"string","size":"string"}}}`

## Submit Local File

Submit a local file to Palo Alto Networks Wildfire for malware analysis. Requires an attachment.

### Endpoint

- **URL:** `publicapi/submit/file`
- **Method:** `POST`

### Input

| **Argument Name**       | **Type** | **Required** | **Description**                 |
| ----------------------- | -------- | ------------ | ------------------------------- |
| `attachments`           | array    | Required     | File to be submitted            |
| `attachments.file`      | string   | Optional     | Parameter for Submit Local File |
| `attachments.file_name` | string   | Optional     | Name of the resource            |

### Input Example

`{"attachments":[{"file":"string","file_name":"Example Name"}]}`

### Output

| **Parameter**                        | **Type** | **Description**                                |
| ------------------------------------ | -------- | ---------------------------------------------- |
| `status_code`                        | number   | HTTP status code of the response               |
| `reason`                             | string   | Response reason phrase                         |
| `wildfire`                           | object   | Output field: wildfire                         |
| `wildfire.upload-file-info`          | object   | Output field: wildfire.upload-file-info        |
| `wildfire.upload-file-info.url`      | string   | URL endpoint for the request                   |
| `wildfire.upload-file-info.filetype` | string   | Type of the resource                           |
| `wildfire.upload-file-info.filename` | string   | Name of the resource                           |
| `wildfire.upload-file-info.sha256`   | string   | Output field: wildfire.upload-file-info.sha256 |
| `wildfire.upload-file-info.md5`      | string   | Output field: wildfire.upload-file-info.md5    |
| `wildfire.upload-file-info.size`     | string   | Output field: wildfire.upload-file-info.size   |

### Output Example

`{"wildfire":{"upload-file-info":{"url":"https://example.com/api/resource","filetype":"string","filename":"Example Name","sha256":"string","md5":"string","size":"string"}}}`

## Submit URLS

Submit up to 1000 URLs for analysis to Palo Alto Networks Wildfire, requiring a data body input.

### Endpoint

- **URL:** `publicapi/submit/links`
- **Method:** `POST`

### Input

| **Argument Name** | **Type** | **Required** | **Description**        |
| ----------------- | -------- | ------------ | ---------------------- |
| `data_body`       | object   | Required     | Data Body              |
| `data_body.urls`  | array    | Required     | List of URLs to submit |

### Input Example

`{"data_body":{"urls":["string"]}}`

### Output

| **Parameter**                      | **Type** | **Description**                                |
| ---------------------------------- | -------- | ---------------------------------------------- |
| `status_code`                      | number   | HTTP status code of the response               |
| `reason`                           | string   | Response reason phrase                         |
| `wildfire`                         | object   | Output field: wildfire                         |
| `wildfire.submit-link-info`        | array    | Output field: wildfire.submit-link-info        |
| `wildfire.submit-link-info.url`    | string   | URL endpoint for the request                   |
| `wildfire.submit-link-info.sha256` | string   | Output field: wildfire.submit-link-info.sha256 |
| `wildfire.submit-link-info.md5`    | string   | Output field: wildfire.submit-link-info.md5    |

### Output Example

`{"wildfire":{"submit-link-info":[{}]}}`

# Response Headers

| **Header**                    | **Description**                                          | **Example**                   |
| ----------------------------- | -------------------------------------------------------- | ----------------------------- |
| Connection                    | HTTP response header: Connection                         |                               |
| Content-Length                | The length of the response body in bytes                 |                               |
| Content-Type                  | The media type of the resource                           | application/json              |
| Date                          | The date and time at which the message was originated    | Thu, 01 Jan 2024 00:00:00 GMT |
| Server                        | Information about the software used by the origin server |                               |
| Transfer-Encoding             | HTTP response header: Transfer-Encoding                  |                               |
| x-envoy-upstream-service-time | HTTP response header: x-envoy-upstream-service-time      |                               |