WildFire-Reports

Details

ID	`WildFire-Reports`
Provider	Palo Alto Networks
Category	Forensics & Malware Analysis
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix Cortex Cloud Cloud Runtime Security XSIAM EDR

README

Generates a Palo Alto Networks WildFire PDF report.

This integration is set up by default on Cortex XSOAR versions 6.5+ with the Threat Intel Module (TIM). It is designed for internal use with the TIM Sample Analysis feature. To run ad hoc CLI commands to generate WildFire reports, use the Palo Alto Networks WildFire v2 integration instead.

This integration was created and tested with version 10.1 of WildFire.

Configure Palo Alto Networks WildFire Reports in Cortex

Parameter	Description	Required
Server base URL (e.g., https://192.168.0.1/publicapi)		True
API Key		False
Trust any certificate (not secure)	Trust any certificate (not secure).	False
Use system proxy settings	Use system proxy settings.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

internal-wildfire-get-report

Retrieves results for a file hash using WildFire.

Base Command

internal-wildfire-get-report

Input

Argument Name	Description	Required
sha256	SHA256 hash to check.	Required

Context Output

There is no context output for this command.

Command Example

!internal-wildfire-get-report sha256=abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890

Human Readable Output

Configuration parameters

insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
server — Server base URL (e.g., https://192.168.0.1/publicapi) (required)
credentials —
token — API Key
agent — Override Agent

Commands (1)

internal-wildfire-get-report
Retrieves results for a file hash using WildFire.

Source

WildFireReports.py WildFireReports_test.py WildFireReports.yml WildFireReports_description.md command_examples.txt

Download History Raw

This integration is set up by default on Cortex XSOAR with the Threat Intel Module (TIM). It is designed for internal use with the TIM Sample Analysis feature. To run ad hoc CLI commands to generate WildFire reports, use the Palo Alto Networks WildFire v2 integration instead.

#### How to retrieve a Palo Alto Networks WildFire Reports API key

Note: If you have a TIM license that is up-to-date, you do not need to set up an API key.
The required information is automatically retrieved from your Cortex XSOAR TIM license.
This API key is used in the *API Key* field in the integration configuration.

1. Navigate to your [WildFire Account](https://wildfire.paloaltonetworks.com/wildfire/account).
2. Log in to your *WildFire* account.
3. Select the *Account* tab from the menu.
4. Copy the API key.

#### Troubleshooting: Override Agent (Advanced)

The *Override Agent* advanced parameter is available for cases where the automatic agent detection fails (e.g., API requests return errors or the **Test** button fails due to an incorrect agent header). By default, the integration auto-detects the correct agent based on the platform. Only change this setting if instructed to do so by support or if auto-detection is not working correctly.

Available options:
- **auto** (default) — Auto-detect based on the platform.
- **xdr** — Cortex XSIAM.
- **xsoartim** — XSOAR TIM API Key.
- **pcc** — Prisma Cloud Compute.
- **prismaaccessapi** — Prisma Access.
- **other** — NGFW or WildFire API.