topic Re: WildFire API Malware Hashes in Automation/API Discussions

WildFire API Malware Hashes

jt1025 — Tue, 29 May 2018 20:02:33 GMT

I'm trying to get the file hash values for all submissions WildFire deems as malware. Is this possible? From what I've read you have to specify the hash value in the API call but I'd just like a list of all values.

Re: WildFire API Malware Hashes

pulukas — Sat, 02 Jun 2018 14:00:07 GMT

I don't think you can. The idea of the API is to query for an Ad Hoc verdict not to pull the data for a separate or offline solution.

Re: WildFire API Malware Hashes

btorresgil — Thu, 07 Jun 2018 03:10:27 GMT

As @pulukas said, you can't do this with the WildFire API, but there are a couple other solutions:

1. The sha256 hashes are available on the Firewalls/Panorama. They can output via syslog or webhook as they happen, or you can query them via the PAN-OS API.

https://www.paloaltonetworks.com/documentation/81/pan-os/xml-api/pan-os-xml-api-request-types/retrieve-logs-api#id9888056f-a9b3-4b36-8033-a8bd5f5ce0bd

2. AutoFocus subscribers can get a list of hashes via the AutoFocus API. Here's an example request for hashes of all 'private' malware samples, which means all samples submitted by your organization to WildFire:

https://www.paloaltonetworks.com/documentation/autofocus/autofocus/autofocus_api/perform-autofocus-searches/search-samples-and-sessions

And an example result showing the sha256, md5, and sha1 hashes of one of the samples returned:

https://www.paloaltonetworks.com/documentation/autofocus/autofocus/autofocus_api/perform-autofocus-searches/view-search-results

Re: WildFire API Malware Hashes

jt1025 — Thu, 07 Jun 2018 15:45:32 GMT

Thanks for the options. I forgot about API and will go that route as we're still on 7.1 and not yet an AutoFocus subscriber.