category: Forensics & Malware Analysis
provider: Palo Alto Networks
sectionorder:
- Connect
- Collect
commonfields:
  id: WildFire-v2
  version: -1
configuration:
- defaultvalue: https://wildfire.paloaltonetworks.com/publicapi
  display: Server base URL (e.g., https://192.168.0.1/publicapi)
  name: server
  required: true
  type: 0
  section: Connect
- displaypassword: API Key
  name: credentials
  type: 9
  hiddenusername: true
  section: Connect
  required: false
- additionalinfo: Source of WildFire API Key - other = NGFW, WildFire API - pcc = Prisma Cloud Compute - prismaaccessapi = Prisma Access - xsoartim = XSOAR TIM API Key
  defaultvalue: other
  display: API Key Type
  name: credentials_source
  options:
  - pcc
  - prismaaccessapi
  - xsoartim
  - xdr
  - other
  type: 15
  section: Connect
  advanced: true
  required: false
- display: Source Reliability
  name: integrationReliability
  required: false
  type: 15
  additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Return warning entry for unsupported file types
  name: suppress_file_type_error
  type: 8
  section: Collect
  advanced: true
  required: false
- display: API Key (Deprecated)
  name: token
  type: 4
  hidden: true
  section: Connect
  advanced: true
  required: false
- display: Create relationships
  defaultvalue: 'true'
  additionalinfo: Create relationships between indicators as part of enrichment.
  name: create_relationships
  type: 8
  section: Collect
  advanced: true
  required: false
description: Perform malware dynamic analysis.
display: Palo Alto Networks WildFire v2
name: WildFire-v2
script:
  commands:
  - arguments:
    - default: true
      description: File hash to check.
      isArray: true
      name: file
    - description: MD5 hash to check.
      isArray: true
      name: md5
    - description: SHA256 hash to check.
      isArray: true
      name: sha256
    description: Retrieve results for a file hash using WildFire.
    name: file
    outputs:
    - contextPath: File.Name
      description: Name of the file.
      type: string
    - contextPath: File.Type
      description: 'File type, for example: "PE".'
      type: string
    - contextPath: File.Size
      description: Size of the file.
      type: string
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: SHA256 hash of the file.
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.DigitalSignature.Publisher
      description: The entity that signed the file for authenticity purposes.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: WildFire.Report.Status
      description: The status of the submission.
      type: string
    - contextPath: WildFire.Report.SHA256
      description: SHA256 hash of the submission.
      type: string
    - contextPath: InfoFile.EntryID
      description: The EntryID of the report file.
      type: Unknown
    - contextPath: InfoFile.Extension
      description: Extension of the report file.
      type: string
    - contextPath: InfoFile.Name
      description: Name of the report file.
      type: string
    - contextPath: InfoFile.Info
      description: Details of the report file.
      type: string
    - contextPath: InfoFile.Size
      description: Size of the report file.
      type: number
    - contextPath: InfoFile.Type
      description: The report file type.
      type: string
    - contextPath: File.FeedRelatedIndicators.value
      description: Indicators that are associated with the file.
      type: String
    - contextPath: File.FeedRelatedIndicators.type
      description: The type of the indicators that are associated with the file.
      type: String
    - contextPath: File.Tags
      description: Tags that are associated with the file.
      type: String
    - contextPath: File.Behavior.details
      description: File behavior details.
      type: String
    - contextPath: File.Behavior.action
      description: File behavior action.
      type: String
  - arguments:
    - description: ID of the entry containing the file to upload.
      isArray: true
      name: upload
    - auto: PREDEFINED
      description: Whether to use Cortex XSOAR's built-in polling to retrieve the result, when ready.
      name: polling
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '60'
      description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: The timeout in seconds until polling ends.
      name: timeout_in_seconds
      defaultValue: '600'
    - description: Used for the inner polling flow. For uploading a file, use the 'upload' argument instead.
      name: md5
      isArray: true
    - auto: PREDEFINED
      defaultValue: 'pdf'
      description: The type of structured report (XML or PDF) to request. Only relevant when polling=true.
      name: format
      predefined:
      - 'xml'
      - 'pdf'
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to receive extended information from WildFire. Only relevant when polling=true.
      name: verbose
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      defaultValue: false
      description: If set to “true”, the report returns extended data, which includes additional outputs.
      name: extended_data
      predefined:
      - 'true'
      - 'false'
    description: Uploads a file to WildFire for analysis.
    name: wildfire-upload
    outputs:
    - contextPath: WildFire.Report.MD5
      description: MD5 hash of the submission.
      type: string
    - contextPath: WildFire.Report.SHA256
      description: SHA256 hash of the submission.
      type: string
    - contextPath: WildFire.Report.FileType
      description: The submission type.
      type: string
    - contextPath: WildFire.Report.Size
      description: The size of the submission.
      type: number
    - contextPath: WildFire.Report.Status
      description: The status of the submission.
      type: string
    - contextPath: File.Name
      description: Name of the file.
      type: string
    - contextPath: File.Type
      description: 'File type, for example: "PE".'
      type: string
    - contextPath: File.Size
      description: Size of the file.
      type: number
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: SHA256 hash of the file.
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.DigitalSignature.Publisher
      description: The entity that signed the file for authenticity purposes.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: InfoFile.EntryID
      description: The EntryID of the report file.
      type: string
    - contextPath: InfoFile.Extension
      description: The extension of the report file.
      type: string
    - contextPath: InfoFile.Name
      description: The name of the report file.
      type: string
    - contextPath: InfoFile.Info
      description: Details of the report file.
      type: string
    - contextPath: InfoFile.Size
      description: The size of the report file.
      type: number
    - contextPath: InfoFile.Type
      description: The report file type.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.URL.Host
      description: Submission related hosts.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.URL.Method
      description: The submission related method.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.URL.URI
      description: The submission related URI.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.URL.UserAgent
      description: The submission related user agent.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.UDP.IP
      description: The submission related IPs, in UDP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.UDP.Port
      description: The submission related ports, in UDP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.UDP.JA3
      description: The submission related JA3s, in UDP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.UDP.JA3S
      description: The submission related JA3Ss, in UDP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.UDP.Country
      description: The submission related countries, in UDP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.TCP.IP
      description: The submission related IPs, in TCP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.TCP.JA3
      description: The submission related JA3s, in TCP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.TCP.JA3S
      description: The submission related JA3Ss, in TCP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.TCP.Country
      description: The submission related countries, in TCP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.TCP.Port
      description: The submission related ports, in TCP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.DNS.Query
      description: The submission DNS queries.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.DNS.Response
      description: The submission DNS responses.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.DNS.Type
      description: The submission DNS Types.
      type: string
    - contextPath: WildFire.Report.Evidence.md5
      description: The submission evidence MD5 hash.
      type: string
    - contextPath: WildFire.Report.Evidence.Text
      description: The submission evidence text.
      type: string
    - contextPath: WildFire.Report.detection_reasons.description
      description: Reason for the detection verdict.
      type: string
    - contextPath: WildFire.Report.detection_reasons.name
      description: Name of the detection.
      type: string
    - contextPath: WildFire.Report.detection_reasons.type
      description: Type of the detection.
      type: string
    - contextPath: WildFire.Report.detection_reasons.verdict
      description: Verdict of the detection.
      type: string
    - contextPath: WildFire.Report.detection_reasons.artifacts
      description: Artifacts of the detection reasons.
      type: unknown
    - contextPath: WildFire.Report.iocs
      description: Associated IOCs.
      type: unknown
    - contextPath: WildFire.Report.verdict
      description: The verdict of the report.
      type: string
    - contextPath: WildFire.Report.Platform
      description: The platform of the report.
      type: string
    - contextPath: WildFire.Report.Software
      description: The software of the report.
      type: string
    - contextPath: WildFire.Report.ProcessList.Service
      description: The process service.
      type: string
    - contextPath: WildFire.Report.ProcessList.ProcessCommand
      description: The process command.
      type: string
    - contextPath: WildFire.Report.ProcessList.ProcessName
      description: The process name.
      type: string
    - contextPath: WildFire.Report.ProcessList.ProcessPid
      description: The process pid.
      type: string
    - contextPath: WildFire.Report.ProcessList.ProcessFile
      description: Lists files that started a child processes, including the process name and the action the process performed.
      type: string
    - contextPath: WildFire.Report.ProcessTree.ProcessName
      description: The process name.
      type: string
    - contextPath: WildFire.Report.ProcessTree.ProcessPid
      description: The process pid.
      type: string
    - contextPath: WildFire.Report.ProcessTree.ProcessText
      description: The action the process performed.
      type: string
    - contextPath: WildFire.Report.ProcessTree.Process.ChildName
      description: The child process name.
      type: string
    - contextPath: WildFire.Report.ProcessTree.Process.ChildPid
      description: The child process pid.
      type: string
    - contextPath: WildFire.Report.ProcessTree.Process.ChildText
      description: The action the child process performed.
      type: string
    - contextPath: WildFire.Report.ExtractedURL.URL
      description: The extracted URL.
      type: string
    - contextPath: WildFire.Report.ExtractedURL.Verdict
      description: The extracted verdict.
      type: string
    - contextPath: WildFire.Report.Summary.Text
      description: The summary of the report.
      type: string
    - contextPath: WildFire.Report.Summary.Details
      description: The details summary of the report.
      type: string
    - contextPath: WildFire.Report.Summary.Behavior
      description: The behavior summary of the report.
      type: string
    - contextPath: WildFire.Report.ELF.ShellCommands
      description: The shell commands.
      type: string
    polling: true
  - arguments:
    - description: URL of the remote file to upload.
      name: upload
    - description: Used for the inner polling flow. For uploading a URL, use the 'upload' argument instead.
      name: url
    - auto: PREDEFINED
      description: Whether to use Cortex XSOAR's built-in polling to retrieve the result, when ready.
      name: polling
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '60'
      description: Interval in seconds between each poll.
      name: interval_in_seconds
    - defaultValue: '600'
      description: The timeout in seconds until polling ends.
      name: timeout_in_seconds
    - auto: PREDEFINED
      defaultValue: 'pdf'
      description: The type of structured report (XML or PDF) to request. Only relevant when polling=true.
      name: format
      predefined:
      - 'xml'
      - 'pdf'
      deprecated: true
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to receive extended information from WildFire. Only relevant when polling=true.
      name: verbose
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      defaultValue: false
      description: If set to “true”, the report returns extended data, which includes additional outputs.
      name: extended_data
      predefined:
      - 'true'
      - 'false'
    description: Uploads the URL of a remote file to WildFire for analysis.
    name: wildfire-upload-file-url
    outputs:
    - contextPath: WildFire.Report.MD5
      description: MD5 hash of the submission.
      type: string
    - contextPath: WildFire.Report.SHA256
      description: SHA256 hash of the submission.
      type: string
    - contextPath: WildFire.Report.Status
      description: The status of the submission.
      type: string
    - contextPath: WildFire.Report.URL
      description: URL of the submission.
      type: string
    - contextPath: File.Name
      description: Name of the file.
      type: string
    - contextPath: File.Type
      description: 'File type, for example: "PE".'
      type: string
    - contextPath: File.Size
      description: Size of the file.
      type: number
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: SHA256 hash of the file.
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.DigitalSignature.Publisher
      description: The entity that signed the file for authenticity purposes.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: InfoFile.EntryID
      description: The EntryID of the report file.
      type: string
    - contextPath: InfoFile.Extension
      description: The extension of the report file.
      type: string
    - contextPath: InfoFile.Name
      description: The name of the report file.
      type: string
    - contextPath: InfoFile.Info
      description: Details of the report file.
      type: string
    - contextPath: InfoFile.Size
      description: The size of the report file.
      type: number
    - contextPath: InfoFile.Type
      description: The report file type.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.URL.Host
      description: The submission related hosts.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.URL.Method
      description: The submission related method.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.URL.URI
      description: The submission related URI.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.URL.UserAgent
      description: The submission related user agent.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.UDP.IP
      description: The submission related IPs, in UDP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.UDP.Port
      description: The submission related ports, in UDP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.UDP.JA3
      description: The submission related JA3s, in UDP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.UDP.JA3S
      description: The Submission related JA3Ss, in UDP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.UDP.Country
      description: The submission related countries, in UDP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.TCP.IP
      description: The submission related IPs, in TCP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.TCP.JA3
      description: The submission related JA3s, in TCP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.TCP.JA3S
      description: The submission related JA3Ss, in TCP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.TCP.Country
      description: The submission related Countries, in TCP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.TCP.Port
      description: The submission related ports, in TCP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.DNS.Query
      description: The submission DNS queries.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.DNS.Response
      description: The submission DNS responses.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.DNS.Type
      description: The submission DNS Types.
      type: string
    - contextPath: WildFire.Report.Evidence.md5
      description: The submission evidence MD5 hash.
      type: string
    - contextPath: WildFire.Report.Evidence.Text
      description: The submission evidence text.
      type: string
    - contextPath: WildFire.Report.detection_reasons.description
      description: Reason for the detection verdict.
      type: string
    - contextPath: WildFire.Report.detection_reasons.name
      description: Name of the detection.
      type: string
    - contextPath: WildFire.Report.detection_reasons.type
      description: Type of the detection.
      type: string
    - contextPath: WildFire.Report.detection_reasons.verdict
      description: Verdict of the detection.
      type: string
    - contextPath: WildFire.Report.detection_reasons.artifacts
      description: Artifacts of the detection reasons.
      type: unknown
    - contextPath: WildFire.Report.iocs
      description: Associated IOCs.
      type: unknown
    - contextPath: WildFire.Report.verdict
      description: The verdict of the report.
      type: string
    - contextPath: WildFire.Report.Platform
      description: The platform of the report.
      type: string
    - contextPath: WildFire.Report.Software
      description: The software of the report.
      type: string
    - contextPath: WildFire.Report.ProcessList.Service
      description: The process service.
      type: string
    - contextPath: WildFire.Report.ProcessList.ProcessCommand
      description: The process command.
      type: string
    - contextPath: WildFire.Report.ProcessList.ProcessName
      description: The process name.
      type: string
    - contextPath: WildFire.Report.ProcessList.ProcessPid
      description: The process pid.
      type: string
    - contextPath: WildFire.Report.ProcessList.ProcessFile
      description: Lists files that started a child processes, including the process name and the action the process performed.
      type: string
    - contextPath: WildFire.Report.ProcessTree.ProcessName
      description: The process name.
      type: string
    - contextPath: WildFire.Report.ProcessTree.ProcessPid
      description: The process pid.
      type: string
    - contextPath: WildFire.Report.ProcessTree.ProcessText
      description: The action the process performed.
      type: string
    - contextPath: WildFire.Report.ProcessTree.Process.ChildName
      description: The child process name.
      type: string
    - contextPath: WildFire.Report.ProcessTree.Process.ChildPid
      description: The child process pid.
      type: string
    - contextPath: WildFire.Report.ProcessTree.Process.ChildText
      description: The action the child process performed.
      type: string
    - contextPath: WildFire.Report.ExtractedURL.URL
      description: The extracted URL.
      type: string
    - contextPath: WildFire.Report.ExtractedURL.Verdict
      description: The extracted verdict.
      type: string
    - contextPath: WildFire.Report.Summary.Text
      description: The summary of the report.
      type: string
    - contextPath: WildFire.Report.Summary.Details
      description: The details summary of the report.
      type: string
    - contextPath: WildFire.Report.Summary.Behavior
      description: The behavior summary of the report.
      type: string
    - contextPath: WildFire.Report.ELF.ShellCommands
      description: The shell commands.
      type: string
    polling: true
  - arguments:
    - description: MD5 hash to check.
      isArray: true
      name: md5
    - description: SHA256 hash to check.
      isArray: true
      name: sha256
    - description: Deprecated. Use the sha256 argument instead.
      isArray: true
      name: hash
    - auto: PREDEFINED
      defaultValue: pdf
      description: The type of structured report (XML ,PDF or MAEC) to request.
      name: format
      predefined:
      - xml
      - pdf
      - maec
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to receive extended information from WildFire.
      name: verbose
      predefined:
      - 'true'
      - 'false'
    - description: Retrieves results for a URL using WildFire. The report will be populated in the context as JSON format.
      isArray: true
      name: url
    - auto: PREDEFINED
      defaultValue: false
      description: If set to “true”, the report returns extended data, which includes additional outputs.
      name: extended_data
      predefined:
      - 'true'
      - 'false'
    description: Retrieves results for a file hash using WildFire.
    name: wildfire-report
    outputs:
    - contextPath: File.Name
      description: Name of the file.
      type: string
    - contextPath: File.Type
      description: 'File type, for example: "PE".'
      type: string
    - contextPath: File.Size
      description: Size of the file.
      type: number
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: SHA256 hash of the file.
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.DigitalSignature.Publisher
      description: The entity that signed the file for authenticity purposes.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: WildFire.Report.Status
      description: The status of the submission.
      type: string
    - contextPath: WildFire.Report.SHA256
      description: SHA256 hash of the submission.
      type: string
    - contextPath: InfoFile.EntryID
      description: The EntryID of the report file.
      type: string
    - contextPath: InfoFile.Extension
      description: The extension of the report file.
      type: string
    - contextPath: InfoFile.Name
      description: The name of the report file.
      type: string
    - contextPath: InfoFile.Info
      description: Details of the report file.
      type: string
    - contextPath: InfoFile.Size
      description: The size of the report file.
      type: number
    - contextPath: InfoFile.Type
      description: The report file type.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.URL.Host
      description: The submission related hosts.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.URL.Method
      description: The submission related method.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.URL.URI
      description: The submission related URI.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.URL.UserAgent
      description: The submission related user agent.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.UDP.IP
      description: The submission related IPs, in UDP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.UDP.Port
      description: The submission related ports, in UDP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.UDP.JA3
      description: The submission related JA3s, in UDP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.UDP.JA3S
      description: The submission related JA3Ss, in UDP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.UDP.Country
      description: The submission related countries, in UDP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.TCP.IP
      description: The submission related IPs, in TCP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.TCP.JA3
      description: The submission related JA3s, in TCP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.TCP.JA3S
      description: The Submission related JA3Ss, in TCP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.TCP.Country
      description: The submission related countries, in TCP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.TCP.Port
      description: The submission related ports, in TCP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.DNS.Query
      description: The submission DNS queries.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.DNS.Response
      description: The submission DNS responses.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.DNS.Type
      description: The submission DNS Types.
      type: string
    - contextPath: WildFire.Report.Evidence.md5
      description: The submission evidence MD5 hash.
      type: string
    - contextPath: WildFire.Report.Evidence.Text
      description: The submission evidence text.
      type: string
    - contextPath: WildFire.Report.detection_reasons.description
      description: Reason for the detection verdict.
      type: string
    - contextPath: WildFire.Report.detection_reasons.name
      description: Name of the detection.
      type: string
    - contextPath: WildFire.Report.detection_reasons.type
      description: Type of the detection.
      type: string
    - contextPath: WildFire.Report.detection_reasons.verdict
      description: Verdict of the detection.
      type: string
    - contextPath: WildFire.Report.detection_reasons.artifacts
      description: Artifacts of the detection reasons.
      type: unknown
    - contextPath: WildFire.Report.iocs
      description: Associated IOCs.
      type: unknown
    - contextPath: WildFire.Report.verdict
      description: The verdict of the report.
      type: string
    - contextPath: WildFire.Report.Platform
      description: The platform of the report.
      type: string
    - contextPath: WildFire.Report.Software
      description: The software of the report.
      type: string
    - contextPath: WildFire.Report.ProcessList.Service
      description: The process service.
      type: string
    - contextPath: WildFire.Report.ProcessList.ProcessCommand
      description: The process command.
      type: string
    - contextPath: WildFire.Report.ProcessList.ProcessName
      description: The process name.
      type: string
    - contextPath: WildFire.Report.ProcessList.ProcessPid
      description: The process pid.
      type: string
    - contextPath: WildFire.Report.ProcessList.ProcessFile
      description: Lists files that started a child processes, including the process name and the action the process performed.
      type: string
    - contextPath: WildFire.Report.ProcessTree.ProcessName
      description: The process name.
      type: string
    - contextPath: WildFire.Report.ProcessTree.ProcessPid
      description: The process pid.
      type: string
    - contextPath: WildFire.Report.ProcessTree.ProcessText
      description: The action the process performed.
      type: string
    - contextPath: WildFire.Report.ProcessTree.Process.ChildName
      description: The child process name.
      type: string
    - contextPath: WildFire.Report.ProcessTree.Process.ChildPid
      description: The child process pid.
      type: string
    - contextPath: WildFire.Report.ProcessTree.Process.ChildText
      description: The action the child process performed.
      type: string
    - contextPath: WildFire.Report.ExtractedURL.URL
      description: The extracted URL.
      type: string
    - contextPath: WildFire.Report.ExtractedURL.Verdict
      description: The extracted verdict.
      type: string
    - contextPath: WildFire.Report.Summary.Text
      description: The summary of the report.
      type: string
    - contextPath: WildFire.Report.Summary.Details
      description: The details summary of the report.
      type: string
    - contextPath: WildFire.Report.Summary.Behavior
      description: The behavior summary of the report.
      type: string
    - contextPath: WildFire.Report.ELF.ShellCommands
      description: The shell commands.
      type: string
    - contextPath: WildFire.Report.maec_report
      description: MAEC report output.
      type: string
  - arguments:
    - description: Comma-separated list of hashes to get the verdict for.
      isArray: true
      name: hash
    - description: The URL to get the verdict for.
      name: url
    description: Returns a verdict for a hash.
    name: wildfire-get-verdict
    outputs:
    - contextPath: WildFire.Verdicts.MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: WildFire.Verdicts.SHA256
      description: SHA256 hash of the file.
      type: string
    - contextPath: WildFire.Verdicts.VerdictDescription
      description: Description of the file verdict.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: WildFire.Verdicts.AnalysisTime
      description: Verdict analysis time.
      type: Date
    - contextPath: WildFire.Verdicts.URL
      description: The URL of the web page.
      type: String
    - contextPath: WildFire.Verdicts.Valid
      description: Is the URL valid.
      type: String
    - contextPath: WildFire.Verdicts.Verdict
      description: Verdict of the file.
      type: Number
  - arguments:
    - description: EntryID of the text file that contains multiple hashes. Limit is 500 hashes.
      isArray: true
      name: EntryID
    - description: A comma-separated list of hashes to get verdicts for.
      isArray: true
      name: hash_list
    description: Returns a verdict regarding multiple hashes, stored in a TXT file or given as a list.
    name: wildfire-get-verdicts
    outputs:
    - contextPath: WildFire.Verdicts.MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: WildFire.Verdicts.SHA256
      description: SHA256 hash of the file.
      type: string
    - contextPath: WildFire.Verdicts.Verdict
      description: Verdict of the file.
      type: number
    - contextPath: WildFire.Verdicts.VerdictDescription
      description: Description of the file verdict.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
  - arguments:
    - description: URL to submit to WildFire.
      isArray: true
      name: upload
    - description: Used for the inner polling flow. For uploading a URL, use the 'upload' argument instead.
      isArray: true
      name: url
    - auto: PREDEFINED
      description: Whether to use Cortex XSOAR's built-in polling to retrieve the result, when ready.
      name: polling
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '60'
      description: Interval in seconds between each poll.
      name: interval_in_seconds
    - defaultValue: '600'
      description: The timeout in seconds until polling ends.
      name: timeout_in_seconds
    - auto: PREDEFINED
      defaultValue: 'pdf'
      description: The type of structured report (XML or PDF) to request. Only relevant when polling=true.
      name: format
      predefined:
      - 'xml'
      - 'pdf'
      deprecated: true
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to receive extended information from WildFire. Only relevant when polling=true.
      name: verbose
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      defaultValue: false
      description: If set to “true”, the report returns extended data, which includes additional outputs.
      name: extended_data
      predefined:
      - 'true'
      - 'false'
    description: Uploads a URL of a webpage to WildFire for analysis.
    name: wildfire-upload-url
    outputs:
    - contextPath: WildFire.Report.MD5
      description: MD5 of the submission.
      type: string
    - contextPath: WildFire.Report.SHA256
      description: SHA256 of the report.
      type: string
    - contextPath: WildFire.Report.Status
      description: The status of the submission.
      type: string
    - contextPath: WildFire.Report.URL
      description: URL of the submission.
      type: string
    - contextPath: File.Name
      description: Name of the file.
      type: string
    - contextPath: File.Type
      description: 'File type, for example: "PE".'
      type: string
    - contextPath: File.Size
      description: Size of the file.
      type: number
    - contextPath: File.MD5
      description: MD5 hash of the file.
      type: string
    - contextPath: File.SHA1
      description: SHA1 hash of the file.
      type: string
    - contextPath: File.SHA256
      description: SHA256 hash of the file.
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: string
    - contextPath: File.DigitalSignature.Publisher
      description: The entity that signed the file for authenticity purposes.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: InfoFile.EntryID
      description: The EntryID of the report file.
      type: string
    - contextPath: InfoFile.Extension
      description: The extension of the report file.
      type: string
    - contextPath: InfoFile.Name
      description: The name of the report file.
      type: string
    - contextPath: InfoFile.Info
      description: Details of the report file.
      type: string
    - contextPath: InfoFile.Size
      description: The size of the report file.
      type: number
    - contextPath: InfoFile.Type
      description: The report file type.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.URL.Host
      description: The submission related hosts.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.URL.Method
      description: The submission related method.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.URL.URI
      description: The submission related URI.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.URL.UserAgent
      description: The submission related user agent.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.UDP.IP
      description: The submission related IPs, in UDP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.UDP.Port
      description: The submission related ports, in UDP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.UDP.JA3
      description: The submission related JA3s, in UDP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.UDP.JA3S
      description: The submission related JA3Ss, in UDP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.UDP.Country
      description: The submission related countries, in UDP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.TCP.IP
      description: The submission related IPs, in TCP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.TCP.JA3
      description: The submission related JA3s, in TCP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.TCP.JA3S
      description: The submission related JA3Ss, in TCP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.TCP.Country
      description: The submission related Countries, in TCP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.TCP.Port
      description: The submission related ports, in TCP protocol.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.DNS.Query
      description: The submission DNS queries.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.DNS.Response
      description: The submission DNS responses.
      type: string
    - contextPath: WildFire.Report.NetworkInfo.DNS.Type
      description: The submission DNS Types.
      type: string
    - contextPath: WildFire.Report.Evidence.md5
      description: The submission evidence MD5 hash.
      type: string
    - contextPath: WildFire.Report.Evidence.Text
      description: The submission evidence text.
      type: string
    - contextPath: WildFire.Report.detection_reasons.description
      description: Reason for the detection verdict.
      type: string
    - contextPath: WildFire.Report.detection_reasons.name
      description: Name of the detection.
      type: string
    - contextPath: WildFire.Report.detection_reasons.type
      description: Type of the detection.
      type: string
    - contextPath: WildFire.Report.detection_reasons.verdict
      description: Verdict of the detection.
      type: string
    - contextPath: WildFire.Report.detection_reasons.artifacts
      description: Artifacts of the detection reasons.
      type: unknown
    - contextPath: WildFire.Report.iocs
      description: Associated IOCs.
      type: unknown
    - contextPath: WildFire.Report.verdict
      description: The verdict of the report.
      type: string
    - contextPath: WildFire.Report.Platform
      description: The platform of the report.
      type: string
    - contextPath: WildFire.Report.Software
      description: The software of the report.
      type: string
    - contextPath: WildFire.Report.ProcessList.Service
      description: The process service.
      type: string
    - contextPath: WildFire.Report.ProcessList.ProcessCommand
      description: The process command.
      type: string
    - contextPath: WildFire.Report.ProcessList.ProcessName
      description: The process name.
      type: string
    - contextPath: WildFire.Report.ProcessList.ProcessPid
      description: The process pid.
      type: string
    - contextPath: WildFire.Report.ProcessList.ProcessFile
      description: Lists files that started a child processes, including the process name and the action the process performed.
      type: string
    - contextPath: WildFire.Report.ProcessTree.ProcessName
      description: The process name.
      type: string
    - contextPath: WildFire.Report.ProcessTree.ProcessPid
      description: The process pid.
      type: string
    - contextPath: WildFire.Report.ProcessTree.ProcessText
      description: The action the process performed.
      type: string
    - contextPath: WildFire.Report.ProcessTree.Process.ChildName
      description: The child process name.
      type: string
    - contextPath: WildFire.Report.ProcessTree.Process.ChildPid
      description: The child process pid.
      type: string
    - contextPath: WildFire.Report.ProcessTree.Process.ChildText
      description: The action the child process performed.
      type: string
    - contextPath: WildFire.Report.ExtractedURL.URL
      description: The extracted URL.
      type: string
    - contextPath: WildFire.Report.ExtractedURL.Verdict
      description: The extracted verdict.
      type: string
    - contextPath: WildFire.Report.Summary.Text
      description: The summary of the report.
      type: string
    - contextPath: WildFire.Report.Summary.Details
      description: The details summary of the report.
      type: string
    - contextPath: WildFire.Report.Summary.Behavior
      description: The behavior summary of the report.
      type: string
    - contextPath: WildFire.Report.ELF.ShellCommands
      description: The shell commands.
      type: string
    polling: true
  - arguments:
    - description: MD5 hash of the sample.
      isArray: true
      name: md5
    - description: SHA256 hash of the sample.
      name: sha256
    description: Retrieves a sample.
    name: wildfire-get-sample
  - arguments:
    - description: URL of the webpage.
      isArray: true
      name: url
      required: true
    - auto: PREDEFINED
      description: Whether to download as screenshots or as downloadable files. if not specified, both will be downloaded.
      name: types
      predefined:
      - download_files
      - screenshot
    description: Get web artifacts for a URL webpage. An empty tgz will be returned, no matter what the verdict is, or even if the URL is malformed.
    name: wildfire-get-url-webartifacts
    outputs:
    - contextPath: InfoFile.EntryID
      description: The EntryID of the web artifacts.
      type: String
    - contextPath: InfoFile.Extension
      description: Extension of the web artifacts.
      type: string
    - contextPath: InfoFile.Name
      description: Name of the web artifacts.
      type: string
    - contextPath: InfoFile.Info
      description: Details of the web artifacts.
      type: string
    - contextPath: InfoFile.Size
      description: Size of the web artifacts.
      type: number
    - contextPath: InfoFile.Type
      description: The web artifacts file type.
      type: string
  dockerimage: demisto/python3:3.12.13.10404775
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- Wildfire Test
- Detonate URL - WildFire-v2 - Test
fromversion: 5.0.0