Export Threat Vault information

[karlh]

Is there a way to either export a complete list out of the Threat Vault or is there a list maintained somewhere of all the current threats?  Looking for something that list the Threat ID, Name, and Severity.  I need this to import into our SIEM so that when it receives the logs from the Palo Alto it is able to translate them correctly.

Thanks in advance.

[HULK]

Hello Karlh,

So far, there is no option to export the entire threat-vault from the PAN firewall. The database will be big enough, as It contains almost 40,000 threat.  I would recommend you to consult with your Palo Alto  SE for the same. He might help you with this.

Thanks

[ajr13]

+1

following if/when this is available.

[ddallmann]

On latest v8 or higher

https[:]//IPADDRESS/api/?key=YOURKEY&type=op&cmd=<show><predefined><xpath>/predefined/threats/vulnerability</xpath></predefined></show>

On Older v7

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSMCA0

[OtakarKlier]

Hello,

The threat vault info can be viewed on the PAN website.

https://threatvault.paloaltonetworks.com/

Regards,

[ddallmann]

When you integrate with SIEM it's nice to have a SOAR function to query an api for more info for example, I'm not aware of any api for the public threat vault.