category: Data Enrichment & Threat Intelligence
provider: Palo Alto Networks
commonfields:
  id: Palo Alto Networks Threat Vault v2
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- defaultvalue: https://api.threatvault.paloaltonetworks.com/
  display: URL
  name: url
  required: true
  type: 0
  section: Connect
- displaypassword: API Key
  name: credentials
  type: 9
  required: true
  hiddenusername: true
  section: Connect
- display: Source Reliability
  name: integrationReliability
  type: 15
  additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: C - Fairly reliable
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- defaultvalue: 14 days
  additionalinfo: The time unit must be days, months, or years.
  display: First fetch timestamp (<number> <time unit>, e.g., 3 days)
  name: first_fetch
  type: 0
  required: false
  section: Collect
- defaultvalue: '1440'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
  section: Collect
description: |-
  Use the Palo Alto Networks Threat Vault to research the latest threats (vulnerabilities/exploits, viruses, and spyware) that Palo Alto Networks next-generation firewalls can detect and prevent.
  Query the Advanced Threat Protection (ATP) API endpoint for Analysis reports and PCAPs.
display: Palo Alto Networks Threat Vault v2
name: Palo Alto Networks Threat Vault v2
script:
  commands:
  - arguments:
    - default: true
      description: A comma-separated list of IPs.
      isArray: true
      name: ip
      required: true
    description: Returns information about IPs.
    name: ip
    outputs:
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: IP.Address
      description: The IP address.
      type: String
    - contextPath: IP.ASN
      description: The IP ASN.
      type: String
    - contextPath: IP.GeoCountry
      description: The IP country.
      type: String
    - contextPath: ThreatVault.IP.ipaddr
      description: The IP address.
      type: String
    - contextPath: ThreatVault.IP.asn
      description: The IP ASN.
      type: String
    - contextPath: ThreatVault.IP.geo
      description: The country where the IP is located.
      type: String
    - contextPath: ThreatVault.IP.release.first_release_version
      description: The release version when the IP feed was released.
      type: String
    - contextPath: ThreatVault.IP.release.first_release_time
      description: The release time when the IP feed was released.
      type: String
    - contextPath: ThreatVault.IP.name
      description: The name of the IP feed entry.
      type: String
    - contextPath: ThreatVault.IP.status
      description: The status of the IP feed entry.
      type: String
  - arguments:
    - default: true
      description: A comma-separated list of SHA256 or MD5 hashes of the antivirus signature.
      isArray: true
      name: file
      required: true
    description: Checks the reputation of an antivirus in Threat Vault.
    name: file
    outputs:
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: String
    - contextPath: ThreatVault.FileInfo.filetype
      description: The file type of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.sha256
      description: The SHA256 of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.sha1
      description: The SHA1 of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.md5
      description: The MD5 of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.size
      description: The size of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.type
      description: The type of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.family
      description: The family of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.platform
      description: The platform of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.wildfire_verdict
      description: The Wildfire verdict.
      type: String
    - contextPath: ThreatVault.FileInfo.create_time
      description: The threat signature creation time.
      type: String
    - contextPath: ThreatVault.FileInfo.signatures
      description: The signatures.
      type: String
  - arguments:
    - default: true
      description: A comma-separated list of CVE names.
      isArray: true
      name: cve
      required: true
    description: Checks the reputation of CVE in Threat Vault.
    name: cve
    outputs:
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: CVE.ID
      description: The CVE ID.
      type: String
    - contextPath: CVE.Description
      description: A description of the CVE.
      type: String
    - contextPath: CVE.CVSS.Score
      description: The CVSS of the CVE.
      type: String
    - contextPath: CVE.Modified
      description: The timestamp of when the CVE was last modified.
      type: String
    - contextPath: CVE.Published
      description: The timestamp of when the CVE was published.
      type: String
    - contextPath: ThreatVault.Vulnerability.id
      description: The unique ID of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.name
      description: The name of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.description
      description: The description of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.category
      description: The threat category of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.min_version
      description: The PAN-OS minimum version.
      type: String
    - contextPath: ThreatVault.Vulnerability.max_version
      description: The PAN-OS maximum version.
      type: String
    - contextPath: ThreatVault.Vulnerability.severity
      description: The severity of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.default_action
      description: The default action when the signature is triggered.
      type: String
    - contextPath: ThreatVault.Vulnerability.cve
      description: The CVE (Common Vulnerabilities and Exposures) of the threat.
      type: Array
    - contextPath: ThreatVault.Vulnerability.vendor.
      description: The vulnerability identifier issued by the vendor on advisories.
      type: Array
    - contextPath: ThreatVault.Vulnerability.reference
      description: The public reference of the threat.
      type: Array
    - contextPath: ThreatVault.Vulnerability.status
      description: The status of the threat (e.g., inactive, active, or released).
      type: String
    - contextPath: ThreatVault.Vulnerability.details
      description: Any additional details of the threat.
      type: Object
    - contextPath: ThreatVault.Vulnerability.ori_release_version
      description: The original release version of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.latest_release_version
      description: The latest release version of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.ori_release_time
      description: The original release time of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.latest_release_time
      description: The latest release time of the threat.
      type: String
  - arguments:
    - description: A comma-separated list of SHA256 hashes of the antivirus signature.
      isArray: true
      name: sha256
    - description: A comma-separated list of MD5 hash of the antivirus signature.
      isArray: true
      name: md5
    - description: A comma-separated list of IDs of the anti-spyware or antivirus signature.
      isArray: true
      name: signature_id
    description: Gets the antivirus or anti-spyware or files signature.
    name: threatvault-threat-signature-get
    outputs:
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: String
    - contextPath: ThreatVault.Vulnerability.id
      description: The unique ID of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.name
      description: The name of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.description
      description: The description of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.category
      description: The threat category of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.min_version
      description: The PAN-OS minimum version.
      type: String
    - contextPath: ThreatVault.Vulnerability.max_version
      description: The PAN-OS maximum version.
      type: String
    - contextPath: ThreatVault.Vulnerability.severity
      description: The severity of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.default_action
      description: The default action when the signature is triggered.
      type: String
    - contextPath: ThreatVault.Vulnerability.cve
      description: The CVE (Common Vulnerabilities and Exposures) of the threat.
      type: Array
    - contextPath: ThreatVault.Vulnerability.vendor.
      description: The vulnerability identifier issued by the vendor on advisories.
      type: Array
    - contextPath: ThreatVault.Vulnerability.reference
      description: The public reference of the threat.
      type: Array
    - contextPath: ThreatVault.Vulnerability.status
      description: The status of the threat (e.g., inactive, active, or released).
      type: String
    - contextPath: ThreatVault.Vulnerability.details
      description: Any additional details of the threat.
      type: Object
    - contextPath: ThreatVault.Vulnerability.ori_release_version
      description: The original release version of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.latest_release_version
      description: The latest release version of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.ori_release_time
      description: The original release time of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.latest_release_time
      description: The latest release time of the threat.
      type: String
    - contextPath: ThreatVault.Spyware.id
      description: The unique ID of the threat.
      type: String
    - contextPath: ThreatVault.Spyware.name
      description: The name of the threat.
      type: String
    - contextPath: ThreatVault.Spyware.description
      description: The description of the threat.
      type: String
    - contextPath: ThreatVault.Spyware.vendor
      description: The spyware identifier issued by the vendor on advisories.
      type: Array
    - contextPath: ThreatVault.Spyware.severity
      description: The severity of the threat.
      type: String
    - contextPath: ThreatVault.Spyware.default_action
      description: The default action when the signature is triggered.
      type: String
    - contextPath: ThreatVault.Spyware.details
      description: Any additional details of the threat.
      type: Object
    - contextPath: ThreatVault.Spyware.reference
      description: The public reference of the threat.
      type: Array
    - contextPath: ThreatVault.Spyware.status
      description: The status of the threat (e.g., inactive, active, or released).
      type: String
    - contextPath: ThreatVault.Spyware.min_version
      description: The PAN-OS minimum version.
      type: String
    - contextPath: ThreatVault.Spyware.max_version
      description: The PAN-OS maximum version.
      type: String
    - contextPath: ThreatVault.Spyware.cve
      description: The CVE (Common Vulnerabilities and Exposures) of the threat.
      type: Array
    - contextPath: ThreatVault.Antivirus.id
      description: The unique ID of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.name
      description: The name of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.action
      description: The action of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.description
      description: The description of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.subtype
      description: The subtype of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.type
      description: The type of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.create_time
      description: The create time of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.related_sha256_hashes
      description: The related sha256 hashes of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.release
      description: Information about the signature release.
      type: String
    - contextPath: ThreatVault.Fileformat.id
      description: The unique ID of the threat.
      type: String
    - contextPath: ThreatVault.Fileformat.name
      description: The name of the threat.
      type: String
    - contextPath: ThreatVault.Fileformat.description
      description: The description of the threat.
      type: String
    - contextPath: ThreatVault.Fileformat.category
      description: The threat category of the threat.
      type: String
    - contextPath: ThreatVault.Fileformat.min_version
      description: The PAN-OS minimum version.
      type: String
    - contextPath: ThreatVault.Fileformat.max_version
      description: The PAN-OS maximum version.
      type: String
    - contextPath: ThreatVault.Fileformat.severity
      description: The severity of the threat.
      type: String
    - contextPath: ThreatVault.Fileformat.default_action
      description: The default action when the signature is triggered.
      type: String
    - contextPath: ThreatVault.Fileformat.cve
      description: The CVE (Common Vulnerabilities and Exposures) of the threat.
      type: Array
    - contextPath: ThreatVault.Fileformat.vendor
      description: The file format identifier issued by vendor on advisories.
      type: Array
    - contextPath: ThreatVault.Fileformat.reference
      description: The public reference of the threat.
      type: Array
    - contextPath: ThreatVault.Fileformat.status
      description: The status of the threat (e.g., inactive, active, or released).
      type: String
    - contextPath: ThreatVault.Fileformat.details
      description: Any additional details of the threat.
      type: Array
    - contextPath: ThreatVault.Fileformat.ori_release_version
      description: The original release version of the threat.
      type: String
    - contextPath: ThreatVault.Fileformat.latest_release_version
      description: The latest release version of the threat.
      type: String
    - contextPath: ThreatVault.Fileformat.ori_release_time
      description: The original release time of the threat.
      type: String
    - contextPath: ThreatVault.Fileformat.latest_release_time
      description: The latest release time of the threat.
      type: String
    - contextPath: ThreatVault.FileInfo.filetype
      description: The file type of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.sha256
      description: The SHA256 of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.sha1
      description: The SHA1 of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.md5
      description: The MD5 of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.size
      description: The size of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.type
      description: The type of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.family
      description: The family of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.platform
      description: The platform of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.wildfire_verdict
      description: The Wildfire verdict.
      type: String
    - contextPath: ThreatVault.FileInfo.create_time
      description: The threat signature creation time.
      type: String
    - contextPath: ThreatVault.FileInfo.signatures
      description: The signatures.
      type: String
    - contextPath: ThreatVault.DNS.id
      description: The unique ID of the threat.
      type: String
    - contextPath: ThreatVault.DNS.name
      description: The name of the threat.
      type: String
    - contextPath: ThreatVault.DNS.description
      description: The description of the threat.
      type: String
    - contextPath: ThreatVault.DNS.type
      description: The type of the threat.
      type: String
    - contextPath: ThreatVault.DNS.severity
      description: The severity of the threat.
      type: String
    - contextPath: ThreatVault.DNS.subtype
      description: The subtype of the threat.
      type: String
    - contextPath: ThreatVault.DNS.action
      description: The action of the threat.
      type: String
    - contextPath: ThreatVault.DNS.create_time
      description: The threat signature creation time.
      type: String
    - contextPath: ThreatVault.DNS.release
      description: Information about the signature release.
      type: String
    - contextPath: ThreatVault.DNS.status
      description: The status of the threat (e.g., inactive, active, or released).
      type: String
    - contextPath: ThreatVault.RTDNS.id
      description: The unique ID of the threat.
      type: String
    - contextPath: ThreatVault.RTDNS.name
      description: The name of the threat.
      type: String
    - contextPath: ThreatVault.RTDNS.description
      description: The description of the threat.
      type: String
    - contextPath: ThreatVault.RTDNS.type
      description: The type of the threat.
      type: String
    - contextPath: ThreatVault.RTDNS.severity
      description: The severity of the threat.
      type: String
    - contextPath: ThreatVault.RTDNS.subtype
      description: The subtype of the threat.
      type: String
    - contextPath: ThreatVault.RTDNS.action
      description: The action of the threat.
      type: String
    - contextPath: ThreatVault.RTDNS.create_time
      description: The threat signature creation time.
      type: String
    - contextPath: ThreatVault.RTDNS.status
      description: The status of the threat (e.g., inactive, active, or released).
      type: String
    - contextPath: ThreatVault.SpywareC2.id
      description: The unique ID of the threat.
      type: String
    - contextPath: ThreatVault.SpywareC2.name
      description: The name of the threat.
      type: String
    - contextPath: ThreatVault.SpywareC2.description
      description: The description of the threat.
      type: String
    - contextPath: ThreatVault.SpywareC2.type
      description: The type of the threat.
      type: String
    - contextPath: ThreatVault.SpywareC2.severity
      description: The severity of the threat.
      type: String
    - contextPath: ThreatVault.SpywareC2.subtype
      description: The subtype of the threat.
      type: String
    - contextPath: ThreatVault.SpywareC2.action
      description: The action of the threat.
      type: String
    - contextPath: ThreatVault.SpywareC2.create_time
      description: The threat signature creation time.
      type: String
    - contextPath: ThreatVault.SpywareC2.release
      description: Information about the signature release.
      type: String
    - contextPath: ThreatVault.SpywareC2.status
      description: The status of the threat (e.g., inactive, active, or released).
      type: String
  - arguments:
    - description: The release version (ex. 8446) or content version (ex. 8446-6886) of the release notes.
      name: version
      required: true
    description: Retrieve the release notes information by version.
    name: threatvault-release-note-get
    outputs:
    - contextPath: ThreatVault.ReleaseNote.release_version
      description: The release version of the update.
      type: String
    - contextPath: ThreatVault.ReleaseNote.type
      description: The type of the release notes.
      type: String
    - contextPath: ThreatVault.ReleaseNote.content_version
      description: The content version of the update.
      type: String
    - contextPath: ThreatVault.ReleaseNote.notes
      description: General notices and reminders.
      type: Array
    - contextPath: ThreatVault.ReleaseNote.decoders
      description: The decoder updates in the release notes.
      type: Array
    - contextPath: ThreatVault.ReleaseNote.spyware.new
      description: List of new entries.
      type: Array
    - contextPath: ThreatVault.ReleaseNote.spyware.modified
      description: List of modified entries.
      type: Array
    - contextPath: ThreatVault.ReleaseNote.spyware.disabled
      description: List of disabled entries.
      type: Array
    - contextPath: ThreatVault.ReleaseNote.vulnerability.new
      description: List of new entries.
      type: Array
    - contextPath: ThreatVault.ReleaseNote.vulnerability.modified
      description: List of modified entries.
      type: Array
    - contextPath: ThreatVault.ReleaseNote.vulnerability.disabled
      description: List of disabled entries.
      type: Array
    - contextPath: ThreatVault.ReleaseNote.applications.new
      description: List of new entries.
      type: Array
    - contextPath: ThreatVault.ReleaseNote.applications.modified
      description: List of modified entries.
      type: Array
    - contextPath: ThreatVault.ReleaseNote.applications.obsoleted
      description: List of obsolete entries.
      type: Array
  - arguments:
    - description: The signature IDs.
      isArray: true
      name: id
    - description: The hash of the sample.
      isArray: true
      name: md5
    - description: The signature names.
      isArray: true
      name: name
    - description: The hash of the sample.
      isArray: true
      name: sha256
    - description: Use together with the other fields to filter out the results.
      name: type
      auto: PREDEFINED
      predefined:
      - ips
      - fileformat
      - spyware
      - vulnerability
      - antivirus
      - dns
      - rtdns
      - spywarec2
    description: Retrieve the threats signature metadata by id, name or sample hash (sha256 or md5) in batch mode. Batch limit is 100 entries.
    name: threatvault-threat-batch-search
    outputs:
    - contextPath: ThreatVault.Vulnerability.id
      description: The unique ID of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.name
      description: The name of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.description
      description: The description of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.category
      description: The threat category of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.min_version
      description: The PAN-OS minimum version.
      type: String
    - contextPath: ThreatVault.Vulnerability.max_version
      description: The PAN-OS maximum version.
      type: String
    - contextPath: ThreatVault.Vulnerability.severity
      description: The severity of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.default_action
      description: The default action when the signature is triggered.
      type: String
    - contextPath: ThreatVault.Vulnerability.cve
      description: The CVE (Common Vulnerabilities and Exposures) of the threat.
      type: Array
    - contextPath: ThreatVault.Vulnerability.vendor.
      description: The vulnerability identifier issued by the vendor on advisories.
      type: Array
    - contextPath: ThreatVault.Vulnerability.reference
      description: The public reference of the threat.
      type: Array
    - contextPath: ThreatVault.Vulnerability.status
      description: The status of the threat (e.g., inactive, active, or released).
      type: String
    - contextPath: ThreatVault.Vulnerability.details
      description: Any additional details of the threat.
      type: Object
    - contextPath: ThreatVault.Vulnerability.ori_release_version
      description: The original release version of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.latest_release_version
      description: The latest release version of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.ori_release_time
      description: The original release time of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.latest_release_time
      description: The latest release time of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.id
      description: The unique ID of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.name
      description: The name of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.action
      description: The action of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.description
      description: The description of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.subtype
      description: The subtype of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.type
      description: The type of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.create_time
      description: The create time of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.related_sha256_hashes
      description: The related SHA256 hashes of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.release
      description: Information about the signature release.
      type: String
    - contextPath: ThreatVault.FileInfo.filetype
      description: The file type of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.sha256
      description: The SHA256 of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.sha1
      description: The SHA1 of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.md5
      description: The MD5 of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.size
      description: The size of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.type
      description: The type of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.family
      description: The family of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.platform
      description: The platform of the file.
      type: String
    - contextPath: ThreatVault.FileInfo.wildfire_verdict
      description: The Wildfire verdict.
      type: String
    - contextPath: ThreatVault.FileInfo.create_time
      description: The threat signature creation time.
      type: String
    - contextPath: ThreatVault.FileInfo.signatures
      description: The signatures.
      type: String
    - contextPath: ThreatVault.Spyware.id
      description: The unique ID of the threat.
      type: String
    - contextPath: ThreatVault.Spyware.name
      description: The name of the threat.
      type: String
    - contextPath: ThreatVault.Spyware.description
      description: The description of the threat.
      type: String
    - contextPath: ThreatVault.Spyware.vendor
      description: The spyware identifier issued by the vendor on advisories.
      type: Array
    - contextPath: ThreatVault.Spyware.severity
      description: The severity of the threat.
      type: String
    - contextPath: ThreatVault.Spyware.default_action
      description: The default action when the signature is triggered.
      type: String
    - contextPath: ThreatVault.Spyware.details
      description: Any additional details of the threat.
      type: Object
    - contextPath: ThreatVault.Spyware.reference
      description: The public reference of the threat.
      type: Array
    - contextPath: ThreatVault.Spyware.status
      description: The status of the threat (e.g., inactive, active, or released).
      type: String
    - contextPath: ThreatVault.Spyware.min_version
      description: The PAN-OS minimum version.
      type: String
    - contextPath: ThreatVault.Spyware.max_version
      description: The PAN-OS maximum version.
      type: String
    - contextPath: ThreatVault.Spyware.cve
      description: The CVE (Common Vulnerabilities and Exposures) of the threat.
      type: Array
    - contextPath: ThreatVault.DNS.id
      description: The unique ID of the threat.
      type: String
    - contextPath: ThreatVault.DNS.name
      description: The name of the threat.
      type: String
    - contextPath: ThreatVault.DNS.description
      description: The description of the threat.
      type: String
    - contextPath: ThreatVault.DNS.type
      description: The type of the threat.
      type: String
    - contextPath: ThreatVault.DNS.severity
      description: The severity of the threat.
      type: String
    - contextPath: ThreatVault.DNS.subtype
      description: The subtype of the threat.
      type: String
    - contextPath: ThreatVault.DNS.action
      description: The action of the threat.
      type: String
    - contextPath: ThreatVault.DNS.create_time
      description: The threat signature creation time.
      type: String
    - contextPath: ThreatVault.DNS.release
      description: Information about the signature release.
      type: String
    - contextPath: ThreatVault.DNS.status
      description: The status of the threat (e.g., inactive, active, or released).
      type: String
    - contextPath: ThreatVault.RTDNS.id
      description: The unique ID of the threat.
      type: String
    - contextPath: ThreatVault.RTDNS.name
      description: The name of the threat.
      type: String
    - contextPath: ThreatVault.RTDNS.description
      description: The description of the threat.
      type: String
    - contextPath: ThreatVault.RTDNS.type
      description: The type of the threat.
      type: String
    - contextPath: ThreatVault.RTDNS.severity
      description: The severity of the threat.
      type: String
    - contextPath: ThreatVault.RTDNS.subtype
      description: The subtype of the threat.
      type: String
    - contextPath: ThreatVault.RTDNS.action
      description: The action of the threat.
      type: String
    - contextPath: ThreatVault.RTDNS.create_time
      description: The threat signature creation time.
      type: String
    - contextPath: ThreatVault.RTDNS.status
      description: The status of the threat (e.g., inactive, active, or released).
      type: String
    - contextPath: ThreatVault.SpywareC2.id
      description: The unique ID of the threat.
      type: String
    - contextPath: ThreatVault.SpywareC2.name
      description: The name of the threat.
      type: String
    - contextPath: ThreatVault.SpywareC2.description
      description: The description of the threat.
      type: String
    - contextPath: ThreatVault.SpywareC2.type
      description: The type of the threat.
      type: String
    - contextPath: ThreatVault.SpywareC2.severity
      description: The severity of the threat.
      type: String
    - contextPath: ThreatVault.SpywareC2.subtype
      description: The subtype of the threat.
      type: String
    - contextPath: ThreatVault.SpywareC2.action
      description: The action of the threat.
      type: String
    - contextPath: ThreatVault.SpywareC2.create_time
      description: The threat signature creation time.
      type: String
    - contextPath: ThreatVault.SpywareC2.release
      description: Information about the signature release.
      type: String
    - contextPath: ThreatVault.SpywareC2.status
      description: The status of the threat (e.g., inactive, active, or released).
      type: String
  - arguments:
    - description: The CVE tied to the signature.
      name: cve
    - description: The vendor ID tied to the signatures.
      name: vendor
    - description: The signature name.
      name: signature-name
    - description: "The release dates range (used with the to-release-date argument), Format: YYYY-MM-DD or timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)."
      name: from-release-date
    - description: "The right boundary of date range query (used with the from-release-date argument), Format: YYYY-MM-DD or timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)."
      name: to-release-date
    - description: The release versions range (used with the to-release-version argument).
      name: from-release-version
    - description: The right boundary of version range query (used with the from-release-version argument).
      name: to-release-version
    - description: "The release date, Format: YYYY-MM-DD or timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)."
      name: release-date
    - description: The release version.
      name: release-version
    - description: The threat type. Use together with the other fields to filter out the results.
      name: type
      auto: PREDEFINED
      predefined:
      - ips
      - fileformat
      - spyware
      - vulnerability
      - antivirus
      - dns
      - rtdns
      - spywarec2
    - description: Page number to get result from. Needs to be used with the page_size argument.
      name: page
    - description: The page size of the returned results. Needs to be used with the page argument.
      name: page_size
    - description: The maximum number of results to return (default is 50).
      name: limit
    description: Retrieves threat metadata. The nature of the query is determined by the query parameter that you provide.
    name: threatvault-threat-search
    outputs:
    - contextPath: ThreatVault.Vulnerability.id
      description: The unique ID of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.name
      description: The name of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.description
      description: The description of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.category
      description: The threat category of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.min_version
      description: The PAN-OS minimum version.
      type: String
    - contextPath: ThreatVault.Vulnerability.max_version
      description: The PAN-OS maximum version.
      type: String
    - contextPath: ThreatVault.Vulnerability.severity
      description: The severity of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.default_action
      description: The default action when the signature is triggered.
      type: String
    - contextPath: ThreatVault.Vulnerability.cve
      description: The CVE (Common Vulnerabilities and Exposures) of the threat.
      type: Array
    - contextPath: ThreatVault.Vulnerability.vendor.
      description: The vulnerability identifier issued by the vendor on advisories.
      type: Array
    - contextPath: ThreatVault.Vulnerability.reference
      description: The public reference of the threat.
      type: Array
    - contextPath: ThreatVault.Vulnerability.status
      description: The status of the threat (e.g., inactive, active, or released).
      type: String
    - contextPath: ThreatVault.Vulnerability.details
      description: Any additional details of the threat.
      type: Object
    - contextPath: ThreatVault.Vulnerability.ori_release_version
      description: The original release version of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.latest_release_version
      description: The latest release version of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.ori_release_time
      description: The original release time of the threat.
      type: String
    - contextPath: ThreatVault.Vulnerability.latest_release_time
      description: The latest release time of the threat.
      type: String
    - contextPath: ThreatVault.Spyware.id
      description: The unique ID of the threat.
      type: String
    - contextPath: ThreatVault.Spyware.name
      description: The name of the threat.
      type: String
    - contextPath: ThreatVault.Spyware.description
      description: The description of the threat.
      type: String
    - contextPath: ThreatVault.Spyware.vendor
      description: The spyware identifier issued by the vendor on advisories.
      type: Array
    - contextPath: ThreatVault.Spyware.severity
      description: The severity of the threat.
      type: String
    - contextPath: ThreatVault.Spyware.default_action
      description: The default action when the signature is triggered.
      type: String
    - contextPath: ThreatVault.Spyware.details
      description: Any additional details of the threat.
      type: Object
    - contextPath: ThreatVault.Spyware.reference
      description: The public reference of the threat.
      type: Array
    - contextPath: ThreatVault.Spyware.status
      description: The status of the threat (e.g., inactive, active, or released).
      type: String
    - contextPath: ThreatVault.Spyware.min_version
      description: The PAN-OS minimum version.
      type: String
    - contextPath: ThreatVault.Spyware.max_version
      description: The PAN-OS maximum version.
      type: String
    - contextPath: ThreatVault.Spyware.cve
      description: The CVE (Common Vulnerabilities and Exposures) of the threat.
      type: Array
    - contextPath: ThreatVault.Antivirus.id
      description: The unique ID of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.name
      description: The name of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.action
      description: The action of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.description
      description: The description of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.subtype
      description: The subtype of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.type
      description: The type of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.create_time
      description: The create time of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.related_sha256_hashes
      description: The related SHA256 hashes of the threat.
      type: String
    - contextPath: ThreatVault.Antivirus.release
      description: Information about the signature release.
      type: String
    - contextPath: ThreatVault.Fileformat.id
      description: The unique ID of the threat.
      type: String
    - contextPath: ThreatVault.Fileformat.name
      description: The name of the threat.
      type: String
    - contextPath: ThreatVault.Fileformat.description
      description: The description of the threat.
      type: String
    - contextPath: ThreatVault.Fileformat.category
      description: The threat category of the threat.
      type: String
    - contextPath: ThreatVault.Fileformat.min_version
      description: The PAN-OS minimum version.
      type: String
    - contextPath: ThreatVault.Fileformat.max_version
      description: The PAN-OS maximum version.
      type: String
    - contextPath: ThreatVault.Fileformat.severity
      description: The severity of the threat.
      type: String
    - contextPath: ThreatVault.Fileformat.default_action
      description: The default action when the signature is triggered.
      type: String
    - contextPath: ThreatVault.Fileformat.cve
      description: The CVE (Common Vulnerabilities and Exposures) of the threat.
      type: Array
    - contextPath: ThreatVault.Fileformat.vendor
      description: The file format identifier issued by the vendor on advisories.
      type: Array
    - contextPath: ThreatVault.Fileformat.reference
      description: The public reference of the threat.
      type: Array
    - contextPath: ThreatVault.Fileformat.status
      description: The status of the threat (e.g., inactive, active, or released).
      type: String
    - contextPath: ThreatVault.Fileformat.details
      description: Any additional details of the threat.
      type: Array
    - contextPath: ThreatVault.Fileformat.ori_release_version
      description: The original release version of the threat.
      type: String
    - contextPath: ThreatVault.Fileformat.latest_release_version
      description: The latest release version of the threat.
      type: String
    - contextPath: ThreatVault.Fileformat.ori_release_time
      description: The original release time of the threat.
      type: String
    - contextPath: ThreatVault.Fileformat.latest_release_time
      description: The latest release time of the threat.
      type: String
    - contextPath: ThreatVault.DNS.id
      description: The unique ID of the threat.
      type: String
    - contextPath: ThreatVault.DNS.name
      description: The name of the threat.
      type: String
    - contextPath: ThreatVault.DNS.description
      description: The description of the threat.
      type: String
    - contextPath: ThreatVault.DNS.type
      description: The type of the threat.
      type: String
    - contextPath: ThreatVault.DNS.severity
      description: The severity of the threat.
      type: String
    - contextPath: ThreatVault.DNS.subtype
      description: The subtype of the threat.
      type: String
    - contextPath: ThreatVault.DNS.action
      description: The action of the threat.
      type: String
    - contextPath: ThreatVault.DNS.create_time
      description: The threat signature creation time.
      type: String
    - contextPath: ThreatVault.DNS.release
      description: Information about the signature release.
      type: String
    - contextPath: ThreatVault.DNS.status
      description: The status of the threat (e.g., inactive, active, or released).
      type: String
    - contextPath: ThreatVault.RTDNS.id
      description: The unique ID of the threat.
      type: String
    - contextPath: ThreatVault.RTDNS.name
      description: The name of the threat.
      type: String
    - contextPath: ThreatVault.RTDNS.description
      description: The description of the threat.
      type: String
    - contextPath: ThreatVault.RTDNS.type
      description: The type of the threat.
      type: String
    - contextPath: ThreatVault.RTDNS.severity
      description: The severity of the threat.
      type: String
    - contextPath: ThreatVault.RTDNS.subtype
      description: The subtype of the threat.
      type: String
    - contextPath: ThreatVault.RTDNS.action
      description: The action of the threat.
      type: String
    - contextPath: ThreatVault.RTDNS.create_time
      description: The threat signature creation time.
      type: String
    - contextPath: ThreatVault.RTDNS.status
      description: The status of the threat (e.g., inactive, active, or released).
      type: String
    - contextPath: ThreatVault.SpywareC2.id
      description: The unique ID of the threat.
      type: String
    - contextPath: ThreatVault.SpywareC2.name
      description: The name of the threat.
      type: String
    - contextPath: ThreatVault.SpywareC2.description
      description: The description of the threat.
      type: String
    - contextPath: ThreatVault.SpywareC2.type
      description: The type of the threat.
      type: String
    - contextPath: ThreatVault.SpywareC2.severity
      description: The severity of the threat.
      type: String
    - contextPath: ThreatVault.SpywareC2.subtype
      description: The subtype of the threat.
      type: String
    - contextPath: ThreatVault.SpywareC2.action
      description: The action of the threat.
      type: String
    - contextPath: ThreatVault.SpywareC2.create_time
      description: The threat signature creation time.
      type: String
    - contextPath: ThreatVault.SpywareC2.release
      description: Information about the signature release.
      type: String
    - contextPath: ThreatVault.SpywareC2.status
      description: The status of the threat (e.g., inactive, active, or released).
      type: String
  - arguments:
    - description: Provides the ATP report by matching the report ID.
      isArray: true
      name: report_id
      required: true
    description: Retrieve the Advanced Threat Prevention (ATP) report by report ID in batch mode. Batch limit is 100 entries. Get one or more ATP reports. Must provide one or more report IDs.
    name: threatvault-atp-batch-report-get
    outputs:
    - contextPath: ThreatVault.ATP.Report
      description: ThreatVault ATP Report ID.
      type: string
    - contextPath: ThreatVault.ATP.Report.err_msg
      description: ThreatVault error message.
      type: string
    - contextPath: ThreatVault.ATP.Report.panos_info.csp_id
      description: ATP Report CSP.
      type: string
    - contextPath: ThreatVault.ATP.Report.panos_info.fw_addr_v4
      description: ATP Report firewall IP.
      type: string
    - contextPath: ThreatVault.ATP.Report.panos_info.fw_app_version
      description: ATP Report content version.
      type: string
    - contextPath: ThreatVault.ATP.Report.panos_info.fw_hostname
      description: ATP Report firewall name.
      type: string
    - contextPath: ThreatVault.ATP.Report.panos_info.fw_model
      description: ATP Report firewall model.
      type: string
    - contextPath: ThreatVault.ATP.Report.panos_info.fw_sw_version
      description: ATP Report firewall PAN-OS.
      type: string
    - contextPath: ThreatVault.ATP.Report.report_id
      description: ATP Report ID.
      type: string
    - contextPath: ThreatVault.ATP.Report.session_info.flow_info.daddr
      description: ATP Report Session Flow destination IP.
      type: string
    - contextPath: ThreatVault.ATP.Report.session_info.flow_info.dport
      description: ATP Report Session Flow destination Port.
      type: string
    - contextPath: ThreatVault.ATP.Report.session_info.flow_info.saddr
      description: ATP Report Session Flow source IP.
      type: string
    - contextPath: ThreatVault.ATP.Report.session_info.flow_info.sport
      description: ATP Report Session Flow source Port.
      type: string
    - contextPath: ThreatVault.ATP.Report.session_info.session_id
      description: ATP Report session ID.
      type: string
    - contextPath: ThreatVault.ATP.Report.session_info.session_timestamp
      description: ATP Report session timestamp.
      type: string
    - contextPath: ThreatVault.ATP.Report.transaction_data.payload_sha256
      description: ATP Report transaction payload sha256.
      type: string
    - contextPath: ThreatVault.ATP.Report.transaction_data.transaction_id
      description: ATP Report transaction payload ID.
      type: string
    - contextPath: ThreatVault.ATP.Report.transaction_data.detection_results.verdict
      description: ATP Report transaction verdict.
      type: string
    - contextPath: ThreatVault.ATP.Report.transaction_data.detection_results.detection_service
      description: ATP Report transaction detection service.
      type: string
    - contextPath: ThreatVault.ATP.Report.transaction_data.detection_results.details.payload_info.Method
      description: ATP Report transaction payload method.
      type: string
    - contextPath: ThreatVault.ATP.Report.transaction_data.detection_results.details.payload_info.User-Agent
      description: ATP Report transaction payload user-agent.
      type: string
    - contextPath: ThreatVault.ATP.Report.transaction_data.detection_results.details.payload_info.Cookie
      description: ATP Report transaction payload cookie.
      type: string
    - contextPath: ThreatVault.ATP.Report.transaction_data.detection_results.details.payload_info.Accept
      description: ATP Report transaction payload accept.
      type: string
    - contextPath: ThreatVault.ATP.Report.transaction_data.detection_results.details.payload_info.Host
      description: ATP Report transaction payload host.
      type: string
    - contextPath: ThreatVault.ATP.Report.transaction_data.detection_results.details.payload_info.URI
      description: ATP Report transaction payload URI.
      type: string
    - contextPath: ThreatVault.ATP.Report.transaction_data.detection_results.details.payload_info.Cache-Control
      description: ATP Report transaction payload cache-control.
      type: string
    - contextPath: ThreatVault.ATP.Report.transaction_data.detection_results.details.payload_info.Version
      description: ATP Report transaction payload version.
      type: string
    - contextPath: ThreatVault.ATP.Report.transaction_data.detection_results.details.payload_info.Connection
      description: ATP Report transaction payload connection.
      type: string
  - arguments:
    - description: Retrieve the ATP report sample (packet capture) by report id.
      name: report_id
      required: true
    description: Retrieve the Advanced Threat Prevention (ATP) analysis report PCAP by reportID
    name: threatvault-atp-report-pcap-get
    outputs:
    - contextPath: ThreatVault.ATP.PCAP.ID
      description: Threatvault ATP PCAP ID.
      type: string
    - contextPath: ThreatVault.ATP.PCAP.Name
      description: Threatvault ATP PCAP name.
      type: string
  dockerimage: demisto/crypto:1.0.0.6932158
  isfetch: true
  script: ''
  subtype: python3
  type: python
tests:
- PANW Threat Vault v2 - Test
fromversion: 6.5.0