WildFire by Palo Alto Networks

Author:: Cortex XSOAR
Support:: xsoar
URL:: https://www.paloaltonetworks.com/cortex

agentixcloudcloud_runtime_securityxsiamEDR

Forensics & Malware Analysis

Integrations (2)

Playbooks (5)

Detonate File From URL - WildFire Deprecated
Detonate URL - WildFire v2.1 Deprecated
Detonate URL - WildFire-v2 Deprecated
WildFire - Detonate file Deprecated
Wildfire Detonate and Analyze File

README

Use the Palo Alto Networks Wildfire integration to automatically identify unknown threats and stop attackers in their tracks by performing malware dynamic analysis.

What does this pack do?

Send a File sample to WildFire.
Upload a file hosted on a website to WildFire.
Submit a webpage to WildFire.
Get a report regarding the sent samples using file hash.
Get sample file from WildFire.
Get verdict regarding multiple hashes (up to 500) using the wildfire-get-verdicts command.

The content pack contains 4 playbooks

WildFire - Detonate File / Detonate File From URL - WildFire - Detonate one or more files using the Wildfire integration. This playbook returns relevant reports to the War Room and file reputations to the context data.
Detonate URL - WildFire v2.1 / Detonate URL - WildFire-v2 - Detonate a webpage or remote file using the WildFire integration. This playbook returns relevant reports to the War Room and file reputations to the context data.

Create an integration instance

To create an instance of the integration, you need the WildFire API key
This API key is used in the API Key field in the integration configuration.

Navigate to and log into your WildFire Account.
Select the Account tab from the menu.
Copy the API key.

Note: If your API key comes from integrations such as Prisma Cloud or Prisma Access ensure that the API source is set in the instance config.

WildFire Server URLs

Use the appropriate server URL in the Server base URL parameter based on your region or cloud environment: