category: Data Enrichment & Threat Intelligence
provider: Palo Alto Networks
commonfields:
  id: Palo Alto Networks Threat Vault
  version: -1
configuration:
- additionalinfo: TIM customers that upgraded to version 6.2 or above, can have this value pre-configured in their main account so no additional input is needed. To use this feature, upgrade your license so it includes the license key.
  display: API Key
  name: api_key
  type: 4
  required: false
- display: Source Reliability
  name: integrationReliability
  type: 15
  additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: D - Not usually reliable
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: Deprecated. Use Threat Vault v2 instead.
display: Palo Alto Networks Threat Vault (Deprecated)
name: Palo Alto Networks Threat Vault
script:
  commands:
  - arguments:
    - description: The SHA256 hash of the antivirus signature.
      name: sha256
    - description: The signature ID of the antivirus.
      name: signature_id
    deprecated: true
    description: Gets the antivirus signature.
    name: threatvault-antivirus-signature-get
    outputs:
    - contextPath: ThreatVault.Antivirus.active
      description: Whether the antivirus signature is active.
      type: Bool
    - contextPath: ThreatVault.Antivirus.category
      description: The category of the antivirus signature.
      type: String
    - contextPath: ThreatVault.Antivirus.createTime
      description: The time the antivirus signature was created.
      type: String
    - contextPath: ThreatVault.Antivirus.release
      description: The release details of the antivirus signature.
      type: Unknown
    - contextPath: ThreatVault.Antivirus.sha256
      description: The sha256 hash of the antivirus signature.
      type: String
    - contextPath: ThreatVault.Antivirus.signatureId
      description: The ID of the antivirus signature.
      type: Number
    - contextPath: ThreatVault.Antivirus.signatureName
      description: The name of the antivirus signature.
      type: String
  - arguments:
    - default: true
      description: The SHA256 hash of the antivirus signature.
      isArray: true
      name: file
      required: true
    deprecated: true
    description: Checks the reputation of an antivirus in Threat Vault.
    name: file
    outputs:
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision.
      type: String
  - arguments:
    - description: The ID of the DNS signature.
      name: dns_signature_id
    deprecated: true
    description: Gets the DNS signature. For more details see the integration README.
    name: threatvault-dns-signature-get-by-id
    outputs:
    - contextPath: ThreatVault.DNS.active
      description: Whether the DNS signature is active.
      type: Bool
    - contextPath: ThreatVault.DNS.category
      description: The category of the DNS signature.
      type: String
    - contextPath: ThreatVault.DNS.createTime
      description: The time the DNS signature was created.
      type: String
    - contextPath: ThreatVault.DNS.domainName
      description: The domain name of the DNS signature.
      type: String
    - contextPath: ThreatVault.DNS.release
      description: The release details of the DNS signature.
      type: Unknown
    - contextPath: ThreatVault.DNS.signatureId
      description: The ID of the DNS signature.
      type: Number
    - contextPath: ThreatVault.DNS.signatureName
      description: The name of the DNS signature.
      type: String
  - arguments:
    - description: ID of the antispyware signature.
      name: signature_id
    deprecated: true
    description: Gets the antispyware signature. For more details see the integration README.
    name: threatvault-antispyware-signature-get-by-id
    outputs:
    - contextPath: ThreatVault.AntiSpyware.firstReleaseVersion
      description: The first released version of the antispyware.
      type: Number
    - contextPath: ThreatVault.AntiSpyware.signatureName
      description: The name of the antispyware signature.
      type: String
    - contextPath: ThreatVault.AntiSpyware.firstReleaseTime
      description: The time the antispyware was first released.
      type: AntiSpyware
    - contextPath: ThreatVault.AntiSpyware.vendor
      description: The antispyware vendor.
      type: String
    - contextPath: ThreatVault.AntiSpyware.latestReleaseTime
      description: The latest release time of the antispyware.
      type: String
    - contextPath: ThreatVault.AntiSpyware.metadata
      description: The metadata of the antispyware.
      type: Unknown
    - contextPath: ThreatVault.AntiSpyware.signatureType
      description: The signature type of the antispyware.
      type: String
    - contextPath: ThreatVault.AntiSpyware.cve
      description: The status of the antispyware CVE.
      type: String
    - contextPath: ThreatVault.AntiSpyware.status
      description: The status of the antispyware.
      type: String
    - contextPath: ThreatVault.AntiSpyware.signatureId
      description: The antispyware signature ID.
      type: Number
    - contextPath: ThreatVault.AntiSpyware.latestReleaseVersion
      description: The latest released version of the antispyware.
      type: Number
  - arguments:
    - description: The IP address to search.
      isArray: true
      name: ip
    deprecated: true
    description: Get the IP address geolocation.
    name: threatvault-ip-geo-get
    outputs:
    - contextPath: ThreatVault.IP.CountryCode
      description: The country code.
      type: String
    - contextPath: ThreatVault.IP.CountryName
      description: The country name.
      type: String
    - contextPath: ThreatVault.IP.ipAddress
      description: The IP address.
      type: String
  - arguments:
    - default: true
      isArray: true
      name: ip
      required: true
      description: IP address to query, e.g., !ip 1.1.1.1
    deprecated: true
    description: Check IP location.
    name: ip
    outputs:
    - contextPath: IP.Address
      description: The IP address.
      type: String
    - contextPath: IP.Geo.Country
      description: The country of the IP address.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
  - arguments:
    - description: The signature name to search.
      name: signature_name
      required: true
    - description: From which signature to return results. Default is 0.
      name: from
    - description: To which signature to return results. Default is from plus 10.
      name: to
    deprecated: true
    description: Initiates an antivirus signature search.
    name: threatvault-antivirus-signature-search
    outputs:
    - contextPath: ThreatVault.Search.search_request_id
      description: The ID that was searched.
      type: String
    - contextPath: ThreatVault.Search.status
      description: The status of the search.
      type: String
  - arguments:
    - description: The signature name to search.
      name: signature_name
    - description: The domain name to search.
      name: domain_name
    - description: From which signature to return results. Default is 0.
      name: from
    - description: To which signature to return results. Default is from plus 10.
      name: to
    deprecated: true
    description: Initiates a DNS signature search.
    name: threatvault-dns-signature-search
    outputs:
    - contextPath: ThreatVault.Search.search_request_id
      description: The ID to search.
      type: String
    - contextPath: ThreatVault.Search.status
      description: The status of the search.
      type: String
  - arguments:
    - description: The signature name to search.
      name: signature_name
    - description: The vendor name to search.
      name: vendor
    - description: The CVE name to search.
      name: cve
    - description: From which signature to return results. Default is 0.
      name: from
    - description: To which signature to return results. Default is from plus 10.
      name: to
    deprecated: true
    description: Initiates an antispyware signature search.
    name: threatvault-antispyware-signature-search
    outputs:
    - contextPath: ThreatVault.Search.search_request_id
      description: The ID to search.
      type: String
    - contextPath: ThreatVault.Search.status
      description: The status of the search.
      type: String
  - arguments:
    - description: The ID to search.
      name: search_request_id
      required: true
    - auto: PREDEFINED
      description: Search type. "ips" for antispyware, "dns" for DNS, and "panav" for antivirus.
      name: search_type
      predefined:
      - ips
      - dns
      - panav
      required: true
    deprecated: true
    description: Initiates an antispyware signature search.
    name: threatvault-signature-search-results
    outputs:
    - contextPath: ThreatVault.Search.search_request_id
      description: The ID that was searched.
      type: String
    - contextPath: ThreatVault.Search.status
      description: The status of the search.
      type: String
    - contextPath: ThreatVault.Search.page_count
      description: The number of results returned in this specific search.
      type: Number
    - contextPath: ThreatVault.Search.total_count
      description: The number of results available for this specific search.
      type: Number
    - contextPath: ThreatVault.Search.search_type
      description: The search type. Can be either "ips", "dns". or "panav".
      type: String
    - contextPath: ThreatVault.Searchf.signatures
      description: A list of all the signatures found for this specific search.
      type: Unknown
  dockerimage: demisto/python3:3.10.1.26972
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- PANW Threat Vault - Signature Search - Test
fromversion: 5.0.0
deprecated: true