Getting Wildfire Events into Playbooks

[r_buchwalder]

Hello

Is there a way to get Wildfire Events in Panorama as a feed into XSOAR and there into a Playbook?

Right now I get those events as Mail and parse them that way - but I guess there is a more elegant way to do so...

Thanks

roger

[gfilippov]

Hi,
Please review the following articles:
https://docs.paloaltonetworks.com/search.html#q=PAN-OS%20EDL&sort=relevancy&layout=card&numberOfResu...]
thanks.

[r_buchwalder]

Hello Gfilippov

Thanks for your answer.

But I can't find any info, what to do on Panorama and what to do on XSOAR.

Right now, I do it via syslog...

thanks

roger

[bkatzir]

Hey @r_buchwalder , We are currently working on a solution to ingest WF events/threat logs of PANOS to Cortex XSOAR as incidents. We are working our way through that, as we are limited to the number of logs we can get using the export API, contrary to syslog.
for reference: https://github.com/demisto/etc/issues/16695

[r_buchwalder]

Hello @bkatzir 

I'm not able to follow your github link - I do get a 404 message...

thanks for the Info anyway. Will have an eye on oncoming release notes.

thanks

roger