Wildfire Reports missing URL

[r_buchwalder]

Hello all

I did some PDF-Requests to Wildfire and getting Info back as xml.

One of those reports are marked as "Malicious" but I do not see, what/why it is Malicious.
So I've investigated and did a curl extract of the sha265 Wildfire Request.

And look! There are infos about URLs in the curl-api request (output as xml):

<extracted_urls>
    <entry domain="blablabla.com" verdict="something"/>
</extracted_urls>

and

<summary>

    <entry score="0.0" id="8016" details="File may reference external resources through the URL/domain name/IP address. Both benign and malicious samples can have this behavior.">
        File contains one or more URL/domain name/IP address
    </entry>
</summary>

Why is it not in the Integration?

So, I did a copy of the Integration and inserted a dirty "update" on it:

(Integration "Palo Alto Networks WildFire v2", Version 1.3.3 - 322974 (Apr 8, 2021))

I've inserted following lines at line 605:

605:

606:        if 'extracted_urls' in report:
607:            feed_related_indicators.append({'value': report["extracted_urls"], 'type': 'URL'})

608:

Next lines would be: (To find it easier to modify)

608:

609:    outputs = {
610:        'Status': 'Success',
611:        'SHA256': file_info.get('sha256')
612:    }

613:

Right now, the Output is with brakets [] and ":

${File.FeedRelatedIndicators.value.entry.@domain}
["blablabla.com"]

${File.FeedRelatedIndicators.value.entry.@verdict}
["something"]

Now my question:
Is Palo Alto able to Update the Integration?

Thanks
roger

[gfilippov · Accepted solution]

Hi,
You can contribute this content via the marketplace, it will be reviewed by our content development team and merged to our content if approved,
thanks.