Palo Alto Networks Threat Vault v2 Feed

Retrieve Threat Vault predefined EDL content for Malicious IP, Known IP, TOR and Bulletproof hosting.

Data Enrichment & Threat Intelligence · ThreatVault Feed · Feed

Details

IDPalo Alto Networks Threat Vault v2 Feed
ProviderPalo Alto Networks
CategoryData Enrichment & Threat Intelligence
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Threat Vault Feed

This integration uses the Threat Vault API to fetch predefined EDL (External Dynamic List) lists.

Configuration

  1. Navigate to Settings > Integrations
  2. Search for PANW Threat Vault Feed.
  3. Click Add instance to create and configure a new integration instance.

Required Parameters

  • API Key: Your PANW Threat Vault API key.
  • Base URL: The base URL for the PANW Threat Vault API.
  • Fetch Interval: How often to fetch new data from the feed (in minutes).

Usage

Once configured, the integration will automatically fetch the specified EDL lists at the defined interval. The fetched data can be used in playbooks, indicators, and other Cortex XSOAR features.

Commands

  • threatvault-get-indicators: Manually fetch indicators from the PANW Threat Vault feed.

Troubleshooting

If you encounter any issues:

  1. Verify your API key is correct and has the necessary permissions.
  2. Check the integration’s logs for any error messages.
  3. Ensure your network allows outbound connections to the PANW Threat Vault API endpoint.

For more information on using this integration, refer to the PANW Threat Vault documentation.

Configuration parameters

  • feed — Fetch indicators
  • url — URL (required)
  • credentials — API Key (required)
  • name — Which EDL to pull indicators from (required)
  • list_format — Response Format (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • feedTags — Tags
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability (required)
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • feedFetchInterval — Feed Fetch Interval
  • limit — Page Size Limit
  • feedBypassExclusionList — Bypass exclusion list
  • tlp_color — Traffic Light Protocol Color

Commands (1)

  • threatvault-get-indicators

    Retrieves indicators from Threat Vault.

Source

FeedThreatVault.py FeedThreatVault_test.py FeedThreatVault.yml FeedThreatVault_description.md
Download History Raw 
## Get Your API Key
  1. Log in to the [Palo Alto Networks Customer Service Portal](https://support.paloaltonetworks.com/Support) with an account that has Super User privileges.
  2. Select **Assets** and then **API Key Management**.
  3. From the **Select an API key** dropdown list, select the API key based on the subscription type.
  4. Set your API key in the API key field of the integration configuration

---
[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/palo-alto-networks-threat-vault-v2)