Palo Alto Networks Threat Vault v2 Feed

Retrieve Threat Vault predefined EDL content for Malicious IP, Known IP, TOR and Bulletproof hosting.

Data Enrichment & Threat Intelligence · ThreatVault Feed · Feed

Details

ID	`Palo Alto Networks Threat Vault v2 Feed`
Provider	Palo Alto Networks
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Threat Vault Feed

This integration uses the Threat Vault API to fetch predefined EDL (External Dynamic List) lists.

Configuration

Navigate to Settings > Integrations
Search for PANW Threat Vault Feed.
Click Add instance to create and configure a new integration instance.

Required Parameters

API Key: Your PANW Threat Vault API key.
Base URL: The base URL for the PANW Threat Vault API.
Fetch Interval: How often to fetch new data from the feed (in minutes).

Usage

Once configured, the integration will automatically fetch the specified EDL lists at the defined interval. The fetched data can be used in playbooks, indicators, and other Cortex XSOAR features.

Commands

threatvault-get-indicators: Manually fetch indicators from the PANW Threat Vault feed.

Troubleshooting

If you encounter any issues:

Verify your API key is correct and has the necessary permissions.
Check the integration’s logs for any error messages.
Ensure your network allows outbound connections to the PANW Threat Vault API endpoint.

For more information on using this integration, refer to the PANW Threat Vault documentation.

Configuration parameters

feed — Fetch indicators
url — URL (required)
credentials — API Key (required)
name — Which EDL to pull indicators from (required)
list_format — Response Format (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
feedTags — Tags
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
limit — Page Size Limit
feedBypassExclusionList — Bypass exclusion list
tlp_color — Traffic Light Protocol Color

Commands (1)

threatvault-get-indicators
Retrieves indicators from Threat Vault.

Source

FeedThreatVault.py FeedThreatVault_test.py FeedThreatVault.yml FeedThreatVault_description.md

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Palo Alto Networks
sectionorder:
- Connect
- Collect
commonfields:
  id: Palo Alto Networks Threat Vault v2 Feed
  version: -1
name: Palo Alto Networks Threat Vault v2 Feed
display: Palo Alto Networks Threat Vault v2 Feed
description: Retrieve Threat Vault predefined EDL content for Malicious IP, Known IP, TOR and Bulletproof hosting.
configuration:
- display: Fetch indicators
  name: feed
  type: 8
  defaultvalue: 'true'
  required: false
  section: Collect
- display: URL
  name: url
  defaultvalue: https://api.threatvault.paloaltonetworks.com/
  type: 0
  required: true
  section: Connect
- display: API Key
  displaypassword: API Key
  name: credentials
  type: 9
  required: true
  hiddenusername: true
  section: Connect
- display: Which EDL to pull indicators from
  name: name
  type: 15
  required: true
  options:
  - panw-known-ip-list
  - panw-highrisk-ip-list
  - panw-torexit-ip-list
  - panw-bulletproof-ip-list
  section: Connect
- display: Response Format
  name: list_format
  type: 15
  required: true
  options:
  - Array
  defaultvalue: 'Array'
  additionalinfo: Only "array" is supported by the API for now.
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Tags
  name: feedTags
  type: 0
  required: false
  additionalinfo: Supports CSV values.
  section: Collect
- display: Indicator Reputation
  name: feedReputation
  type: 18
  required: false
  options:
  - None
  - Good
  - Suspicious
  - Bad
  additionalinfo: Indicators from this integration instance will be marked with this reputation.
  section: Collect
- display: Source Reliability
  name: feedReliability
  defaultvalue: B - Usually reliable
  type: 15
  required: true
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  additionalinfo: Reliability of the source providing the intelligence data.
  section: Collect
- name: feedExpirationPolicy
  display: ''
  defaultvalue: indicatorType
  type: 17
  required: false
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  section: Collect
- name: feedExpirationInterval
  display: ''
  defaultvalue: '20160'
  type: 1
  required: false
  section: Collect
- display: Feed Fetch Interval
  name: feedFetchInterval
  defaultvalue: '240'
  type: 19
  required: false
  section: Collect
- display: Page Size Limit
  name: limit
  defaultvalue: '200'
  type: 0
  required: false
  additionalinfo: Maximum number of indicators to fetch per API request (pagination). Default is 200, maximum is 1000. If you encounter timeout issues, consider reducing this limit.
  section: Collect
  advanced: true
- display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
  section: Collect
  additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
- display: Traffic Light Protocol Color
  type: 15
  additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  section: Collect
script:
  script: ''
  type: python
  commands:
  - name: threatvault-get-indicators
    arguments:
    - name: name
      description: The name of the predefined EDL to retrieve.
      required: true
      auto: PREDEFINED
      predefined:
      - panw-known-ip-list
      - panw-highrisk-ip-list
      - panw-torexit-ip-list
      - panw-bulletproof-ip-list
    - name: version
      description: The version of the EDL to retrieve.
      required: true
      auto: PREDEFINED
      predefined:
      - latest
      defaultValue: latest
    outputs:
    - contextPath: ThreatVault.EDL.ipaddr
      description: EDL indicators.
      type: String
    - contextPath: ThreatVault.EDL.name
      description: EDL name.
      type: string
    - contextPath: ThreatVault.EDL.content_version
      description: Content version number.
      type: number
    - contextPath: ThreatVault.EDL.count
      description: Count of entries.
      type: number
    description: Retrieves indicators from Threat Vault.
  dockerimage: demisto/python3:3.12.13.10116658
  feed: true
  runonce: false
  subtype: python3
  isFetchSamples: true
fromversion: 6.10.0
tests:
- No tests (auto formatted)