topic Re: Export Threat Vault information in General Topics

Export Threat Vault information

karlh — Wed, 14 May 2014 19:53:31 GMT

Is there a way to either export a complete list out of the Threat Vault or is there a list maintained somewhere of all the current threats? Looking for something that list the Threat ID, Name, and Severity. I need this to import into our SIEM so that when it receives the logs from the Palo Alto it is able to translate them correctly.

Thanks in advance.

Re: Export Threat Vault information

HULK — Wed, 14 May 2014 21:59:29 GMT

Hello Karlh,

So far, there is no option to export the entire threat-vault from the PAN firewall. The database will be big enough, as It contains almost 40,000 threat. I would recommend you to consult with your Palo Alto SE for the same. He might help you with this.

Thanks

Re: Export Threat Vault information

ajr0 — Thu, 26 Mar 2015 18:27:12 GMT

following if/when this is available.

Re: Export Threat Vault information

ddallmann — Mon, 30 Dec 2019 19:42:31 GMT

On latest v8 or higher

https[:]//IPADDRESS/api/?key=YOURKEY&type=op&cmd=<show><predefined><xpath>/predefined/threats/vulnerability</xpath></predefined></show>

On Older v7

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSMCA0

Re: Export Threat Vault information

OtakarKlier — Mon, 30 Dec 2019 23:07:50 GMT

Hello,

The threat vault info can be viewed on the PAN website.

https://threatvault.paloaltonetworks.com/

Regards,

Re: Export Threat Vault information

ddallmann — Tue, 31 Dec 2019 15:57:40 GMT

When you integrate with SIEM it's nice to have a SOAR function to query an api for more info for example, I'm not aware of any api for the public threat vault.