Unit 42 Feed

Unit 42 Feed integration provides threat intelligence from Palo Alto Networks Unit 42 research team.

Data Enrichment & Threat Intelligence · Unit 42 Threat Intelligence by Palo Alto Networks · Feed

Details

IDUnit 42 Feed
ProviderPalo Alto Networks
CategoryData Enrichment & Threat Intelligence
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10404775
Supported ModulesAgentix Cortex Cloud EDR XSIAM Cloud Runtime Security Cloud Posture Security

README

Unit 42 Feed integration provides threat intelligence from Palo Alto Networks Unit 42 research team.

Configure Unit 42 Feed in Cortex

Parameter Description Required
Fetch indicators Select this check box to fetch indicators (default selected). True
Feed Types Choose the requested indicator feeds. Indicators feed and Threat Objects (actors, malware, campaigns, techniques, etc.) feed (default is both). True
Indicator Types Comma-separated list of indicator types to fetch (File, IP, URL, Domain). If not specified, all indicator types are fetched. False
Maximum Indicators Per Fetch Maximum number of indicators to fetch per type. False
Source Reliability Reliability of the source providing the intelligence context. True
Tags Supports CSV values. False
Traffic Light Protocol Color (TLP). The Traffic Light Protocol (TLP) designation is to apply to indicators fetched from the feed. False
Indicator Reputation Indicators from this integration instance will be marked with this reputation True
Feed Expiration Policy The feed’s expiration policy. True
Indicator Expiration Interval The indicator’s expiration policy. False
Create relationships Create relationships with other indicators. False
Bypass exclusion list When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system. False
Use system proxy settings   False
Trust any certificate (not secure)   False

How the Maximum Indicators Per Fetch Parameter Works

The Maximum Indicators Per Fetch parameter controls the maximum number of indicators fetched per type during each fetch cycle. The integration enforces a total limit of 100,000 indicators across all types to ensure optimal performance.

Limit Calculation Algorithm

The limit per indicator type is calculated using the following logic:

  1. If the limit is not specified or is negative:
    • Default limit per type = 100,000 / total_number_of_types
  2. If the limit × total_number_of_types > 100,000:
    • Adjusted limit per type = 100,000 / total_number_of_types
  3. Otherwise:
    • Uses the specified limit per type.

Examples

Example 1: No Limit Specified with 4 Types

  • Configuration: Threat Objects + 3 indicator types (IP, Domain, URL)
  • Total number of types: 4
  • Calculation: 100,000 / 4 = 25,000 per type
  • Result: Fetches up to 25,000 of each type (100,000 total)

Example 2: Limit Exceeds Total

  • Configuration: Limit = 30,000, with 4 types selected
  • Calculation: 30,000 × 4 = 120,000 > 100,000 (exceeds total limit)
  • Adjusted: 100,000 / 4 = 25,000 per type
  • Result: Fetches up to 25,000 of each type (100,000 total)

Example 3: Limit within Total

  • Configuration: Limit = 20,000, with 4 types selected
  • Calculation: 20,000 × 4 = 80,000 ≤ 100,000 (within total limit)
  • Result: Fetches up to 20,000 of each type (80,000 total)

Example 4: Single Type

  • Configuration: Limit not specified, only IP indicators selected
  • Total types: 1
  • Calculation: 100,000 / 1 = 100,000 per type
  • Result: Fetches up to 100,000 IP indicators

Fetch Priority Order

When multiple types are configured, the integration fetches in the following priority order:

  1. Threat Objects (if enabled)
  2. IP indicators
  3. Domain indicators
  4. URL indicators
  5. File indicators

If any type returns fewer indicators than its allocated limit, the unused quota is added to the last enabled type in the priority order, allowing it to fetch up to the total limit of 100,000 indicators.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

unit42-get-indicators

Gets indicators from the feed.

Base Command

unit42-get-indicators

Input

Argument Name Description Required
indicator_types Comma-separated list of indicator types to fetch (File, IP, URL, Domain). If not specified, all indicator types are fetched. Possible values are: File, IP, URL, Domain. Default is File,IP,URL,Domain. Optional
limit The maximum number of indicators to return. The default is 10. The maximum is 5000. Default is 10. Optional

Context Output

There is no context output for this command.

unit42-get-threat-objects

Gets threat objects from the feed.

Base Command

unit42-get-threat-objects

Input

Argument Name Description Required
limit The maximum number of threat objects to return. The default is 10. The maximum is 5000. Default is 10. Optional

Context Output

There is no context output for this command.

Troubleshooting

  • HTTP 403 Forbidden error when fetching indicators behind a corporate proxy or firewall.
    • This occurs when the proxy or firewall blocks outbound requests to the Unit 42 Feed API endpoint (prod-us.tas.crtx.paloaltonetworks.com), which is not listed in the standard Cortex XSOAR System Requirements documentation.
    • Resolution: Add prod-us.tas.crtx.paloaltonetworks.com (or the wildcard *.tas.crtx.paloaltonetworks.com) to your proxy or firewall allowlist. The integration requires outbound HTTPS (port 443) access to the following endpoints:
      • https://prod-us.tas.crtx.paloaltonetworks.com/api/v1/feeds/indicators
      • https://prod-us.tas.crtx.paloaltonetworks.com/api/v1/feeds/threat_objects

Configuration parameters

  • feed — Fetch indicators
  • feed_types — Feed Types
  • indicator_types — Indicator Types
  • limit — Maximum Indicators Per Fetch
  • feedFetchInterval — Feed Fetch Interval
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability
  • feedTags — Tags
  • tlp_color — Traffic Light Protocol Color (TLP).
  • feedExpirationPolicy —
  • feedExpirationInterval — Indicator Expiration Interval
  • create_relationships — Create relationships
  • feedIncremental — Incremental feed
  • feedBypassExclusionList — Bypass exclusion list
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)

Commands (2)

  • unit42-get-indicators

    Gets indicators from the feed.

  • unit42-get-threat-objects

    Gets threat objects from the feed.

Source

Unit42Feed.py Unit42Feed_test.py Unit42Feed.yml Unit42Feed_description.md command_examples.txt
Download History Raw 
## Unit 42 Feed

Use the **Unit 42 Feed** integration to fetch indicators and threat objects from Palo Alto Networks Unit 42's comprehensive threat feed. This integration provides continuous access to high-quality indicators of compromise (IOCs) and contextual threat intelligence.

### Prerequisite

This integration requires a Cortex Threat Intelligence Management (TIM) license.

### Configuration Parameters

- **Feed Types**: Select which types of objects to fetch (Indicators, Threat Objects, or both)
- **Indicator Types**: Choose specific indicator types to collect (IP, Domain, URL, File)
- **Source Reliability**: Configure the reliability level for feed context (default: A++ - Reputation script)

---
[View Integration Documentation](https://xsoar.pan.dev/docs/reference/integrations/unit-42-feed)