Unit 42 Feed

Unit 42 Feed integration provides threat intelligence from Palo Alto Networks Unit 42 research team.

Data Enrichment & Threat Intelligence · Unit 42 Threat Intelligence by Palo Alto Networks · Feed

Details

ID	`Unit 42 Feed`
Provider	Palo Alto Networks
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10404775`
Supported Modules	Agentix Cortex Cloud EDR XSIAM Cloud Runtime Security Cloud Posture Security

README

Unit 42 Feed integration provides threat intelligence from Palo Alto Networks Unit 42 research team.

Configure Unit 42 Feed in Cortex

Parameter	Description	Required
Fetch indicators	Select this check box to fetch indicators (default selected).	True
Feed Types	Choose the requested indicator feeds. Indicators feed and Threat Objects (actors, malware, campaigns, techniques, etc.) feed (default is both).	True
Indicator Types	Comma-separated list of indicator types to fetch (File, IP, URL, Domain). If not specified, all indicator types are fetched.	False
Maximum Indicators Per Fetch	Maximum number of indicators to fetch per type.	False
Source Reliability	Reliability of the source providing the intelligence context.	True
Tags	Supports CSV values.	False
Traffic Light Protocol Color (TLP).	The Traffic Light Protocol (TLP) designation is to apply to indicators fetched from the feed.	False
Indicator Reputation	Indicators from this integration instance will be marked with this reputation	True
Feed Expiration Policy	The feed’s expiration policy.	True
Indicator Expiration Interval	The indicator’s expiration policy.	False
Create relationships	Create relationships with other indicators.	False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.	False
Use system proxy settings		False
Trust any certificate (not secure)		False

How the Maximum Indicators Per Fetch Parameter Works

The Maximum Indicators Per Fetch parameter controls the maximum number of indicators fetched per type during each fetch cycle. The integration enforces a total limit of 100,000 indicators across all types to ensure optimal performance.

Limit Calculation Algorithm

The limit per indicator type is calculated using the following logic:

If the limit is not specified or is negative:
- Default limit per type = 100,000 / total_number_of_types
If the limit × total_number_of_types > 100,000:
- Adjusted limit per type = 100,000 / total_number_of_types
Otherwise:
- Uses the specified limit per type.

Examples

Example 1: No Limit Specified with 4 Types

Configuration: Threat Objects + 3 indicator types (IP, Domain, URL)
Total number of types: 4
Calculation: 100,000 / 4 = 25,000 per type
Result: Fetches up to 25,000 of each type (100,000 total)

Example 2: Limit Exceeds Total

Configuration: Limit = 30,000, with 4 types selected
Calculation: 30,000 × 4 = 120,000 > 100,000 (exceeds total limit)
Adjusted: 100,000 / 4 = 25,000 per type
Result: Fetches up to 25,000 of each type (100,000 total)

Example 3: Limit within Total

Configuration: Limit = 20,000, with 4 types selected
Calculation: 20,000 × 4 = 80,000 ≤ 100,000 (within total limit)
Result: Fetches up to 20,000 of each type (80,000 total)

Example 4: Single Type

Configuration: Limit not specified, only IP indicators selected
Total types: 1
Calculation: 100,000 / 1 = 100,000 per type
Result: Fetches up to 100,000 IP indicators

Fetch Priority Order

When multiple types are configured, the integration fetches in the following priority order:

Threat Objects (if enabled)
IP indicators
Domain indicators
URL indicators
File indicators

If any type returns fewer indicators than its allocated limit, the unused quota is added to the last enabled type in the priority order, allowing it to fetch up to the total limit of 100,000 indicators.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

unit42-get-indicators

Gets indicators from the feed.

Base Command

unit42-get-indicators

Input

Argument Name	Description	Required
indicator_types	Comma-separated list of indicator types to fetch (File, IP, URL, Domain). If not specified, all indicator types are fetched. Possible values are: File, IP, URL, Domain. Default is File,IP,URL,Domain.	Optional
limit	The maximum number of indicators to return. The default is 10. The maximum is 5000. Default is 10.	Optional

Context Output

There is no context output for this command.

unit42-get-threat-objects

Gets threat objects from the feed.

Base Command

unit42-get-threat-objects

Input

Argument Name	Description	Required
limit	The maximum number of threat objects to return. The default is 10. The maximum is 5000. Default is 10.	Optional

Context Output

There is no context output for this command.

Troubleshooting

HTTP 403 Forbidden error when fetching indicators behind a corporate proxy or firewall.
- This occurs when the proxy or firewall blocks outbound requests to the Unit 42 Feed API endpoint (prod-us.tas.crtx.paloaltonetworks.com), which is not listed in the standard Cortex XSOAR System Requirements documentation.
- Resolution: Add prod-us.tas.crtx.paloaltonetworks.com (or the wildcard *.tas.crtx.paloaltonetworks.com) to your proxy or firewall allowlist. The integration requires outbound HTTPS (port 443) access to the following endpoints:
  - https://prod-us.tas.crtx.paloaltonetworks.com/api/v1/feeds/indicators
  - https://prod-us.tas.crtx.paloaltonetworks.com/api/v1/feeds/threat_objects

Configuration parameters

feed — Fetch indicators
feed_types — Feed Types
indicator_types — Indicator Types
limit — Maximum Indicators Per Fetch
feedFetchInterval — Feed Fetch Interval
feedReputation — Indicator Reputation
feedReliability — Source Reliability
feedTags — Tags
tlp_color — Traffic Light Protocol Color (TLP).
feedExpirationPolicy —
feedExpirationInterval — Indicator Expiration Interval
create_relationships — Create relationships
feedIncremental — Incremental feed
feedBypassExclusionList — Bypass exclusion list
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)

Commands (2)

unit42-get-indicators
Gets indicators from the feed.
unit42-get-threat-objects
Gets threat objects from the feed.

Source

Unit42Feed.py Unit42Feed_test.py Unit42Feed.yml Unit42Feed_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Palo Alto Networks
commonfields:
  id: Unit 42 Feed
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- display: Fetch indicators
  additionalinfo: Select this check box to fetch indicators (default selected).
  name: feed
  type: 8
  defaultvalue: 'true'
  section: Collect
- display: Feed Types
  additionalinfo: Choose the requested indicator feeds. Indicators feed and Threat Objects (actors, malware, campaigns, techniques, etc.) feed (default is both).
  name: feed_types
  type: 16
  options:
  - "Indicators"
  - "Threat Objects"
  required: false
  defaultvalue: Indicators,Threat Objects
  section: Collect
  advanced: true
- display: Indicator Types
  additionalinfo: Comma-separated list of indicator types to fetch (File, IP, URL, Domain). If not specified, all indicator types are fetched.
  name: indicator_types
  type: 16
  options:
  - File
  - IP
  - URL
  - Domain
  defaultvalue: File,IP,URL,Domain
  required: false
  section: Collect
  advanced: true
- display: Maximum Indicators Per Fetch
  name: limit
  type: 0
  defaultvalue: '100000'
  additionalinfo: |-
    Maximum number of indicators to fetch per type. 
    Example: limit=20,000 with 4 types selected = 80,000 total indicators.
    
    The total (limit × number of types) is automatically capped at 100,000.
    If limit × types > 100,000, the limit per type is adjusted.
    Example: limit=30,000 with 4 types selected = 120,000 total indicators
    adjusted to 25,000 per type (100,000 / 4 = 25,000).
    
    Fetch priority order:
    1. Threat Objects
    2. IPs
    3. Domains
    4. URLs
    5. Files
    
    Default (total for all types): 100,000. Maximum (total for all types): 100,000.
  required: false
  section: Collect
  advanced: true
- display: Feed Fetch Interval
  additionalinfo: Don't set the feed fetch interval to less than 12 hours.
  name: feedFetchInterval
  type: 19
  defaultvalue: '720'
  required: false
  section: Collect
  advanced: true
  hidden: true
- display: Indicator Reputation
  additionalinfo: Indicators from this integration instance will be marked with this reputation.
  name: feedReputation
  type: 18
  options:
  - None
  - Good
  - Suspicious
  - Bad
  defaultvalue: None
  required: false
  section: Collect
  advanced: true
- display: Source Reliability
  additionalinfo: Reliability of the source providing the intelligence context.
  name: feedReliability
  type: 15
  options:
  - A++ - Reputation script
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  defaultvalue: A++ - Reputation script
  required: false
  section: Collect
  advanced: true
- display: Tags
  name: feedTags
  additionalinfo: Supports CSV values.
  type: 0
  required: false
  section: Collect
  advanced: true
- display: Traffic Light Protocol Color (TLP).
  name: tlp_color
  additionalinfo: The Traffic Light Protocol (TLP) designation applied to indicators fetched from the feed.
  type: 15
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  defaultvalue: AMBER
  required: false
  section: Collect
  advanced: true
- display: ''
  name: feedExpirationPolicy
  additionalinfo: The feed's expiration policy.
  type: 17
  options:
  - Indicator Type
  - Time Interval
  - Never Expired
  defaultvalue: Indicator Type
  required: false
  section: Collect
  advanced: true
- display: Indicator Expiration Interval
  additionalinfo: The indicator's expiration policy.
  name: feedExpirationInterval
  defaultvalue: "20160"
  type: 1
  required: false
  section: Collect
  advanced: true
- display: Create relationships
  additionalinfo: Create relationships with other indicators.
  name: create_relationships
  type: 8
  defaultvalue: 'true'
  required: false
  section: Collect
  advanced: true
- display: Incremental feed
  additionalinfo: Incremental feeds pull only new or modified indicators that have been sent from the integration. If the indicator is new or modified on the 3rd-party vendor's side, only indicators that are new or modified are sent to Cortex. Therefore, all indicators coming from these feeds are labeled new or modified.
  name: feedIncremental
  defaultvalue: 'true'
  hidden: true
  required: false
  type: 8
  section: Collect
  advanced: true
- display: Bypass exclusion list
  name: feedBypassExclusionList
  additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  defaultvalue: 'false'
  type: 8
  required: false
  section: Collect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- defaultvalue: 'false'
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
description: Unit 42 Feed integration provides threat intelligence from Palo Alto Networks Unit 42 research team.
display: Unit 42 Feed
name: Unit 42 Feed
script:
  commands:
  - arguments:
    - name: indicator_types
      description: Comma-separated list of indicator types to fetch (File, IP, URL, Domain). If not specified, all indicator types are fetched.
      auto: PREDEFINED
      predefined:
      - File
      - IP
      - URL
      - Domain
      defaultValue: 'File,IP,URL,Domain'
      required: false
    - defaultValue: '10'
      description: The maximum number of indicators to return. The default is 10. The maximum is 5000.
      name: limit
    description: Gets indicators from the feed.
    name: unit42-get-indicators
  - arguments:
    - defaultValue: '10'
      description: The maximum number of threat objects to return. The default is 10. The maximum is 5000.
      name: limit
    description: Gets threat objects from the feed.
    name: unit42-get-threat-objects
  dockerimage: demisto/python3:3.12.13.10404775
  feed: true
  runonce: false
  script: '-'
  type: python
  subtype: python3
fromversion: 6.10.0
supportedModules:
- agentix
- xsiam
tests:
- No tests (auto formatted)