link submission API call doesnt appear to be working.

Reply
L0 Member

link submission API call doesnt appear to be working.

When I submit a URL for analysis via Wildfire Public API.  

curl -F 'apikey=myapikeyenteredhere' -F 'link=https://www.paloaltonetworks.com/' 'https://wildfire.paloaltonetworks.com/publicapi/submit/link'

 

I get a http status code of 200 and receive the submit link info (md5  & sha256).

<?xml version="1.0" encoding="UTF-8"?>
<wildfire>
<submit-link-info>
<url>https://www.paloaltonetworks.com/</url>
<sha256>a3c31e89a841df37d77d00f17f3f6a25751c23116f2a141095f93170e8aa37b5</sha256>
<md5>d7192254cc42b490e039ef327de73bda</md5>
</submit-link-info>
</wildfire>

 

However when i go to get the verdict or the analysis report using the either the md5 or the sha256, i receive a -102 verdict (unknown, or cannot find sample in database) . 

<?xml version="1.0" encoding="UTF-8"?>
<wildfire>
<get-verdict-info>
<sha256></sha256>
<verdict>-102</verdict>
<md5>d7192254cc42b490e039ef327de73bda</md5>
</get-verdict-info>
</wildfire>

 

I also dont see the submission on my wildfire dashboard. I have tried with various URLs, using curl and through scripts; with the same result.  Using the wildfire dashboard, the link was able to be submitted successfully. 

L2 Linker

Re: link submission API call doesnt appear to be working.

Same here.

 

Submitting a link goes fine, but the resulting verdict always gave a -102.

 

I’m sure the submission was successful, because in the wildfire dashboard I can see the ‘daily uploads remaining’ decreasing. (I also don’t see the submission itself)

 

Also tried submitting an URL instead of a link, to submit the test file. (https://wildfire.paloaltonetworks.com/publicapi/test/pe), which runs fine. I was able to retrieve a correct verdict of 1.

 

At this moment I’m not sure what submitting a link should do. What is wildfire going to do with the link submitted?

As the documentation state’s: “The submit/link resource should not be confused with the submit/url resource. Use the submit/link resource for a website, but use /submit/url for files hosted on a website.”

 

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!