Cyware Orchestrate

The following configuration parameters are required for the WildFire app to communicate with the Palo Alto WildFire enterprise application. The parameters can be configured by creating instances in the app.

This action retrieves verdict about a hash from Palo Alto.

Action Input Parameters

Example Request

[
    {
        "hash": "dca86121cc7427e375fd24fe5871d727"
    }
]

This action retrieves verdict about a URL from Palo Alto.

Action Input Parameters

Example Request

[
    {
        "url": "www.sampledomain.com/samples"
    }
]

This action retrieves the web artifacts found during the analysis of the specified web page URL from Palo Alto.

Action Input Parameters

Example Request

[
    {
        "download_type": "screenshots",
        "file_name": "https://wildfire.testdomain.com/get/sample.pdf",
        "url": "www.sampledomain.com/samples"
    }
]

This action retrieves a report from Palo Alto using the Hash value.

Action Input Parameters

Example Request

[
    {
        "file_hash": "b0cfc14687e42e2236db247f5c7d86",
        "file_name": "https://wildfire.testdomain.com/get/sample",
        "download_format": "pdf"
    }
]

This action retrieves a packet capture (PCAP) recorded during the analysis of a particular sample from Palo Alto. Use the hash value (MD5 or SHA-256) of the sample file and also specify the platform of the desired PCAP to indicate which PCAP must be returned.

Action Input Parameters

Example Request

[
    {
        "file_hash": "b0cfc14687e42e2236db247f5c7d86",
        "file_name": "https://wildfire.testdomain.com/get/sample.pdf",
        "platform_id": "Windows XP"
    }
]

This action retrieves and downloads the sample files from Palo Alto based on the MD5 or SHA-256 hash value.

Action Input Parameters

Example Request

[
    {
        "file_hash": "b0cfc14687e42e2236db247f5c7d861a",
        "file_name": "https://wildfire.testdomain.com/get/sample.pdf"
    }
]

This action submits a website link to Palo Alto for analysis.

Action Input Parameters

Example Request

[
    {
        "url": "www.sampledomain.com/samples"
    }
]

This action submits a remote file to Palo Alto for analysis.

Action Input Parameters

Example Request

[
    {
        "url": "http://www.samplefile.com/samples/pdf.pdf"
    }
]

This action submits a local file to Palo Alto for analysis.

Action Input Parameters

Example Request

[
    {
        "file_name": "sample.pdf",
        "file_path": "c:\sample.pdf"
    }
]

This action retrieves a verdict from Palo Alto for a sample based on the MD5 or SHA-256 hash or a web page based on the URL. The verdict indicates if the sample is benign, malware, phishing or grayware.

Action Input Parameters

Example Request

[
    {
        "file_type": "MD5",
        "file_value": "c8d9094c495e4af57c932ac413b65ef132063acc"
    }
]