Wildfire API

[edwinchristopher]

i am working on paloalto VM version 5.0.6 and tying to read reports from wildfire with the help of API using cURL.

i am pulling the report on the basis of "device_id" and "report_id" but getting error.

curl -i -k -F device_id=[SERIAL NUMBER] -F report_id=[TID FROM LOG] -F format=xml

are above options are supported in version 5.0.6?if yes then anything that i am missing in my command.if not then in which version this will be supported.

[kadak · Accepted solution]

Hello Edwin,

Three variables are passable in a GET request to the Wildfire API  - apikey,device_id and report_id.

The following request should return a XML containing the information from the the Wildfire report including the sha256 of the file:

https://wildfire.paloaltonetworks.com/publicapi/report?apikey=<YOUR-API-KEY>&device_id=<YOUR-DEVICE-...

Also, you can use curl to get a report:

curl -i -d apikey=<YOUR-API-KEY -d device_id=<YOUR-DEVICE-SERIAL> -d report_id=<YOUR-REPORT-ID> https://wildfire.paloaltonetworks.com/publicapi/report 

Here is a good link for Wildfire's API guide.

https://www.paloaltonetworks.com/documentation/wildfire-portal-api-doc.html

Please let me know if the above suggestions were helped you!

Regards,

Kunal Adak

[edwinchristopher]

Thanks kunal,

Thats what exactly i was loking or searching for.

[kadak]

Hello Edwin,

Glad that you got what you were looking for.

Regards,

Kunal Adak.

[HYamanaka]

Hello,  

I'm trying to figure out the GET Syntax for 7.0 wildfire wihtout the use of CURL.

I've tried the following format but it doesn't seem to work.

https://wildfire.paloaltonetworks.com/publicapi/get/report?apikey=<api key>?hash=<hash>&format=xml

Getting the following message:

<error>

<error-message>'Method is not supported'</error-message>

</error>

Any help is greatly appreciated.

[Raymond-01]

Hi There,

Did you get your problem solved? If yes, could you tell me how?

Thank you.

Raymond