Wildfire Reports missing URL

cancel
Showing results for 
Search instead for 
Did you mean: 

Wildfire Reports missing URL

L2 Linker

Hello all

 

I did some PDF-Requests to Wildfire and getting Info back as xml.

 

One of those reports are marked as "Malicious" but I do not see, what/why it is Malicious.
So I've investigated and did a curl extract of the sha265 Wildfire Request.

 

And look! There are infos about URLs in the curl-api request (output as xml):

 

<extracted_urls>
    <entry domain="blablabla.com" verdict="something"/>
</extracted_urls>

 

and

 

<summary>

    <entry score="0.0" id="8016" details="File may reference external resources through the URL/domain name/IP address. Both benign and malicious samples can have this behavior.">
        File contains one or more URL/domain name/IP address
    </entry>
</summary>

 

Why is it not in the Integration?


So, I did a copy of the Integration and inserted a dirty "update" on it:

(Integration "Palo Alto Networks WildFire v2", Version 1.3.3 - 322974 (Apr 8, 2021))


I've inserted following lines at line 605:

 

605:

606:        if 'extracted_urls' in report:
607:            feed_related_indicators.append({'value': report["extracted_urls"], 'type': 'URL'})

608:

 

Next lines would be: (To find it easier to modify)

 

608:

609:    outputs = {
610:        'Status': 'Success',
611:        'SHA256': file_info.get('sha256')
612:    }

613:

Right now, the Output is with brakets [] and ":

 

${File.FeedRelatedIndicators.value.entry.@domain}
["blablabla.com"]

 

${File.FeedRelatedIndicators.value.entry.@verdict}
["something"]

 

Now my question:
Is Palo Alto able to Update the Integration?

 

Thanks
roger

1 REPLY 1

L1 Bithead

Hi,
You can contribute this content via the marketplace, it will be reviewed by our content development team and merged to our content if approved,
thanks.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!