topic Re: CVE and Threat Signature in General Topics

CVE and Threat Signature

GLorhammer — Mon, 28 Aug 2017 15:27:54 GMT

In looking at the threats in the Vulnerability Protection profile only a relatively small number have CVEs associated with them. Is there a way to get a list of those that do without just scrolling through the pages of threats in the GUI? Also, is there somewhere that the whole list of vulnerabilities is posted from PA? I suspect not as this is probably proprietary but in case there is, where?

Thanks.

Re: CVE and Threat Signature

Remo — Mon, 28 Aug 2017 16:01:49 GMT

On https://threatvault.paloaltonetworks.com is a searchable database of all the different signatures ... only metadata and not, as you already expected, the details on how the signature actually looks like that is used in PAN-OS.

For your first question: It is possible to pull a signaturelist including CVE numbers over the PAN-OS API

Re: CVE and Threat Signature

GLorhammer — Mon, 28 Aug 2017 16:45:47 GMT

Thanks for the feedback. The threat vault is great for searching for individual threats, but not for getting a list of all of them.

I'm looking at the XML API guide and don't see the command for pulling the entire signature list to put in a request. Do you have a link to the page that explains it, or at least the command that would pull it in the CLI and I can put that in the API request?

Re: CVE and Threat Signature

Remo — Mon, 28 Aug 2017 20:28:12 GMT

https://FIREWALLNAME-OR-IP/api/?type=config&action=get&xpath=/config/predefined/threats/vulnerability

But if you are already on 8.0 this works only with 8.0.3. In the other 8.0 versions there is a bug, so CVEs are not shown there.

Re: CVE and Threat Signature

ddallmann — Mon, 30 Dec 2019 19:34:35 GMT

https[:]//IPADDRESS/api/?key=YOURKEY&type=op&cmd=<show><predefined><xpath>/predefined/threats/vulnerability</xpath></predefined></show>