link submission API call doesnt appear to be working.

[engineering3226]

When I submit a URL for analysis via Wildfire Public API.  

curl -F 'apikey=myapikeyenteredhere' -F 'link=https://www.paloaltonetworks.com/' 'https://wildfire.paloaltonetworks.com/publicapi/submit/link'

I get a http status code of 200 and receive the submit link info (md5  & sha256).

<?xml version="1.0" encoding="UTF-8"?>
<wildfire>
<submit-link-info>
<url>https://www.paloaltonetworks.com/</url>
<sha256>a3c31e89a841df37d77d00f17f3f6a25751c23116f2a141095f93170e8aa37b5</sha256>
<md5>d7192254cc42b490e039ef327de73bda</md5>
</submit-link-info>
</wildfire>

However when i go to get the verdict or the analysis report using the either the md5 or the sha256, i receive a -102 verdict (unknown, or cannot find sample in database) . 

<?xml version="1.0" encoding="UTF-8"?>
<wildfire>
<get-verdict-info>
<sha256></sha256>
<verdict>-102</verdict>
<md5>d7192254cc42b490e039ef327de73bda</md5>
</get-verdict-info>
</wildfire>

I also dont see the submission on my wildfire dashboard. I have tried with various URLs, using curl and through scripts; with the same result.  Using the wildfire dashboard, the link was able to be submitted successfully. 

[Sjoerd]

Same here.

Submitting a link goes fine, but the resulting verdict always gave a -102.

I’m sure the submission was successful, because in the wildfire dashboard I can see the ‘daily uploads remaining’ decreasing. (I also don’t see the submission itself)

Also tried submitting an URL instead of a link, to submit the test file. (https://wildfire.paloaltonetworks.com/publicapi/test/pe), which runs fine. I was able to retrieve a correct verdict of 1.

At this moment I’m not sure what submitting a link should do. What is wildfire going to do with the link submitted?

As the documentation state’s: “The submit/link resource should not be confused with the submit/url resource. Use the submit/link resource for a website, but use /submit/url for files hosted on a website.”