WildFire-Reports

Details

ID	`WildFire-Reports`
Provider	Palo Alto Networks
Category	Forensics & Malware Analysis
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix Cortex Cloud Cloud Runtime Security XSIAM EDR

README

Generates a Palo Alto Networks WildFire PDF report.

This integration is set up by default on Cortex XSOAR versions 6.5+ with the Threat Intel Module (TIM). It is designed for internal use with the TIM Sample Analysis feature. To run ad hoc CLI commands to generate WildFire reports, use the Palo Alto Networks WildFire v2 integration instead.

This integration was created and tested with version 10.1 of WildFire.

Configure Palo Alto Networks WildFire Reports in Cortex

Parameter	Description	Required
Server base URL (e.g., https://192.168.0.1/publicapi)		True
API Key		False
Trust any certificate (not secure)	Trust any certificate (not secure).	False
Use system proxy settings	Use system proxy settings.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

internal-wildfire-get-report

Retrieves results for a file hash using WildFire.

Base Command

internal-wildfire-get-report

Input

Argument Name	Description	Required
sha256	SHA256 hash to check.	Required

Context Output

There is no context output for this command.

Command Example

!internal-wildfire-get-report sha256=abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890

Human Readable Output

Configuration parameters

insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
server — Server base URL (e.g., https://192.168.0.1/publicapi) (required)
credentials —
token — API Key
agent — Override Agent

Commands (1)

internal-wildfire-get-report
Retrieves results for a file hash using WildFire.

Source

WildFireReports.py WildFireReports_test.py WildFireReports.yml WildFireReports_description.md command_examples.txt

Download History Raw

category: Forensics & Malware Analysis
provider: Palo Alto Networks
sectionorder:
- Connect
- Collect
commonfields:
  id: WildFire-Reports
  version: -1
configuration:
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- defaultvalue: https://wildfire.paloaltonetworks.com/publicapi
  display: Server base URL (e.g., https://192.168.0.1/publicapi)
  name: server
  required: true
  type: 0
  section: Connect
- name: credentials
  type: 9
  displaypassword: API Key
  hiddenusername: true
  section: Connect
  required: false
- display: API Key
  name: token
  type: 4
  fromlicense: encrypted
  hidden: true
  section: Connect

  required: false
- display: Override Agent
  additionalinfo: Override the agent header sent with WildFire API requests. auto = auto-detect based on platform (XSOAR/XSIAM), xdr = Cortex XSIAM, xsoartim = XSOAR TIM, pcc = Prisma Cloud Compute, prismaaccessapi = Prisma Access, other = NGFW
  name: agent
  type: 15
  section: Connect
  advanced: true
  required: false
  defaultvalue: auto
  options:
  - auto
  - xdr
  - xsoartim
  - prismaaccessapi
  - pcc
  - other

description: Generates a Palo Alto Networks WildFire PDF report. For internal use with the TIM Sample Analysis feature.
display: Palo Alto Networks WildFire Reports
name: WildFire-Reports
defaultEnabled: true
script:
  commands:
  - arguments:
    - description: SHA256 hash to check.
      name: sha256
      required: true
    description: Retrieves results for a file hash using WildFire.
    name: internal-wildfire-get-report
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.5.0
tests:
- No tests (auto formatted)