Palo Alto Networks Threat Vault v2 Feed

Retrieve Threat Vault predefined EDL content for Malicious IP, Known IP, TOR and Bulletproof hosting.

Data Enrichment & Threat Intelligence · ThreatVault Feed · Feed

Details

ID	`Palo Alto Networks Threat Vault v2 Feed`
Provider	Palo Alto Networks
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Threat Vault Feed

This integration uses the Threat Vault API to fetch predefined EDL (External Dynamic List) lists.

Configuration

Navigate to Settings > Integrations
Search for PANW Threat Vault Feed.
Click Add instance to create and configure a new integration instance.

Required Parameters

API Key: Your PANW Threat Vault API key.
Base URL: The base URL for the PANW Threat Vault API.
Fetch Interval: How often to fetch new data from the feed (in minutes).

Usage

Once configured, the integration will automatically fetch the specified EDL lists at the defined interval. The fetched data can be used in playbooks, indicators, and other Cortex XSOAR features.

Commands

threatvault-get-indicators: Manually fetch indicators from the PANW Threat Vault feed.

Troubleshooting

If you encounter any issues:

Verify your API key is correct and has the necessary permissions.
Check the integration’s logs for any error messages.
Ensure your network allows outbound connections to the PANW Threat Vault API endpoint.

For more information on using this integration, refer to the PANW Threat Vault documentation.

Configuration parameters

feed — Fetch indicators
url — URL (required)
credentials — API Key (required)
name — Which EDL to pull indicators from (required)
list_format — Response Format (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
feedTags — Tags
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
limit — Page Size Limit
feedBypassExclusionList — Bypass exclusion list
tlp_color — Traffic Light Protocol Color

Commands (1)

threatvault-get-indicators
Retrieves indicators from Threat Vault.

Source

FeedThreatVault.py FeedThreatVault_test.py FeedThreatVault.yml FeedThreatVault_description.md

Download History Raw

import FeedThreatVault
import pytest
from CommonServerPython import *
from FeedThreatVault import Client, fetch_indicators_command, main, parse_indicator_for_fetch, threatvault_get_indicators_command

CLIENT = Client(
    base_url="example.com",
    api_key="api_key",
    verify=False,
    proxy=False,
    reliability="B - Usually reliable",
)


EDL_RESPONSE = {
    "success": "true",
    "link": {"next": "null", "previous": "null"},
    "count": 201,
    "data": {
        "version": "1",
        "name": "panw-bulletproof-ip-list",
        "ipaddr": [
            "192.168.1.0-192.168.1.255",
            "192.168.0.0-192.168.0.255",
        ],
    },
    "message": "Successful",
}

EDL_RESPONSE_2 = {
    "success": "true",
    "link": {"next": "null", "previous": "null"},
    "count": 201,
    "data": {
        "version": "1",
        "name": "panw-bulletproof-ip-list",
        "ipaddr": [],
    },
    "message": "Successful",
}


def _open_json_file(path):
    with open(path) as f:
        return json.loads(f.read())


def test_fetch_indicators_command(mocker):
    expected_response = _open_json_file("test_data/fetch_indicators_results.json")
    mocker.patch.object(CLIENT, "get_indicators_request", side_effect=[EDL_RESPONSE, EDL_RESPONSE_2])
    run_time, results = fetch_indicators_command(CLIENT, "example-edl-list", "array", "TLP:CLEAR", "EXAMPLE")
    assert results == expected_response


def test_fetch_indicators_command_raises_exception(mocker):
    mocker.patch.object(CLIENT, "get_indicators_request", side_effect=DemistoException("Test exception"))
    with pytest.raises(DemistoException):
        fetch_indicators_command(CLIENT, "example-edl-list", "array", "TLP:CLEAR", "EXAMPLE")


def test_threatvault_get_indicators_command(mocker):
    expected_results = _open_json_file("test_data/threatvault_get_indicators_results.json")
    mocker.patch.object(CLIENT, "get_indicators_request", side_effect=[EDL_RESPONSE, EDL_RESPONSE_2])
    args = {"name": "test", "version": "1"}
    results = threatvault_get_indicators_command(client=CLIENT, list_format="array", args=args)
    assert results.to_context() == expected_results


def test_threatvault_get_indicators_command_raises_exception(mocker):
    mocker.patch.object(CLIENT, "get_indicators_request", side_effect=DemistoException("Test exception"))
    args = {"name": "test", "version": "1"}
    with pytest.raises(DemistoException):
        threatvault_get_indicators_command(client=CLIENT, list_format="array", args=args)


def test_parse_indicator_for_fetch():
    expected_results = _open_json_file("test_data/expected_parsed_indicator.json")
    indicator = _open_json_file("test_data/fetch_indicators_results.json")[0]
    parsed_indicator = parse_indicator_for_fetch(indicator, tags="tag1, tag2", tlp_color="TLP:CLEAR", feed_tag_name="EXAMPLE")
    assert parsed_indicator.items() <= expected_results.items()


def test_threatvault_main_command_success(mocker):
    expected_results = _open_json_file("test_data/expected_return_results.json")
    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "url": "https://example.com",
            "name": "EDL_name",
            "api_key": "api_key",
            "list_format": "array",
            "proxy": False,
            "verify_certificate": False,
            "reliability": "B - Usually reliable",
        },
    )
    mocker.patch.object(CLIENT, "get_indicators_request", return_value=EDL_RESPONSE)
    mocker.patch.object(demisto, "args", return_value={"name": "test", "version": "1"})
    mocker.patch.object(demisto, "command", return_value="threatvault-get-indicators")
    mocker.patch.object(
        FeedThreatVault,
        "threatvault_get_indicators_command",
        return_value=_open_json_file("test_data/threatvault_get_indicators_results.json"),
    )
    mock_return_results = mocker.patch.object(FeedThreatVault, "return_results")
    main()
    assert mock_return_results.called
    assert mock_return_results.call_args[0][0] == expected_results


def test_threatvault_main_bad_command(mocker):
    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "url": "https://example.com",
            "name": "EDL_name",
            "api_key": "api_key",
            "list_format": "array",
            "proxy": False,
            "verify_certificate": False,
            "reliability": "B - Usually reliable",
        },
    )
    mocker.patch.object(demisto, "command", return_value="bad-command")
    mock_return_error = mocker.patch.object(FeedThreatVault, "return_error")
    mocker.patch("sys.stdout", new=mocker.MagicMock())

    main()

    assert mock_return_error.called
    error_message = mock_return_error.call_args[0][0]
    assert "Failed to execute bad-command command. The command not implemented" in error_message