Palo Alto Networks Threats API

openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Threats API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Threats
  description: Threat signature lookup and metadata retrieval.
paths:
  /threats:
    get:
      operationId: getThreats
      summary: Palo Alto Networks Get Threat Signatures
      description: Retrieves threat signature metadata from the Threat Vault. Supports filtering by signature type, ID, SHA-256 hash, name, CVE identifier, and date range. Returns antivirus, anti-spyware, vulnerability protection, DNS security, and file type signature records.
      tags:
      - Threats
      parameters:
      - name: type
        in: query
        description: Signature type to filter results.
        schema:
          type: string
          enum:
          - antivirus
          - antispyware
          - vulnerability
          - dns
          - fileformat
        example: dns
      - name: id
        in: query
        description: Specific signature ID to retrieve.
        schema:
          type: integer
        example: 942
      - name: sha256
        in: query
        description: SHA-256 hash to look up associated threat signatures.
        schema:
          type: string
        example: fb3a5e00a1b4048bd5ae9bfe7fb263550abc9ecd5ae4876459215b04129e655d
      - name: name
        in: query
        description: Partial or exact signature name to search.
        schema:
          type: string
        example: Branch Gateway 77
      - name: cve
        in: query
        description: CVE identifier to find associated vulnerability signatures.
        schema:
          type: string
          example: CVE-2021-44228
        example: CVE-2021-44228
      - name: from
        in: query
        description: Start date for filtering signatures by release date (YYYY-MM-DD format).
        schema:
          type: string
          format: date
        example: '2026-05-06'
      - name: to
        in: query
        description: End date for filtering signatures by release date (YYYY-MM-DD format).
        schema:
          type: string
          format: date
        example: '2025-05-01'
      - name: offset
        in: query
        description: Number of records to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of signatures to return.
        schema:
          type: integer
          default: 10
          maximum: 100
        example: 10
      responses:
        '200':
          description: Threat signatures returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreatList'
              examples:
                GetThreats200Example:
                  summary: Default getThreats 200 response
                  x-microcks-default: true
                  value:
                    success: true
                    data:
                      zingbox:
                      - id: 675
                        name: Primary Sensor 96
                        type: fileformat
                        subtype: custom
                        severity: informational
                        description: Suspicious detected Security policy applied network network applied firewall.
                        cve:
                        - example-cve_item
                        - example-cve_item
                        default_action: reset-client
                        min_version: 10.0.1
                        max_version: 5.1.5
                        status: released
                        ori_release_version: 3.0.5
                        latest_release_version: 5.7.0
                        first_release_time: '2025-11-23T03:19:43Z'
                        latest_release_time: '2024-07-12T01:32:30Z'
                        sha256:
                        - example-sha256_item
                        - example-sha256_item
                    count: 508
                    total: 403
                    offset: 515
                    limit: 625
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /threats/history:
    get:
      operationId: getThreatHistory
      summary: Palo Alto Networks Get Signature History
      description: Retrieves the version history of a specific threat signature including all previous releases, modifications, and associated content versions. Useful for tracking signature changes over time.
      tags:
      - Threats
      parameters:
      - name: id
        in: query
        required: true
        description: Signature ID to retrieve version history for.
        schema:
          type: integer
        example: 514
      - name: type
        in: query
        required: true
        description: Signature type.
        schema:
          type: string
          enum:
          - antivirus
          - antispyware
          - vulnerability
          - dns
          - fileformat
        example: dns
      - name: offset
        in: query
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        schema:
          type: integer
          default: 10
          maximum: 100
        example: 10
      responses:
        '200':
          description: Signature history returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreatHistoryList'
              examples:
                GetThreatHistory200Example:
                  summary: Default getThreatHistory 200 response
                  x-microcks-default: true
                  value:
                    success: false
                    data:
                    - id: 915
                      name: Branch Agent 35
                      version: 4.1.4
                      release_time: '2026-12-25T01:36:47Z'
                      action: deprecated
                    - id: 915
                      name: Branch Agent 35
                      version: 4.1.4
                      release_time: '2026-12-25T01:36:47Z'
                      action: deprecated
                    total: 799
                    offset: 559
                    limit: 217
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    ThreatSignature:
      type: object
      description: Threat signature metadata record.
      properties:
        id:
          type: integer
          description: Unique signature identifier.
          example: 675
        name:
          type: string
          description: Signature name.
          example: Primary Sensor 96
        type:
          type: string
          enum:
          - antivirus
          - antispyware
          - vulnerability
          - dns
          - fileformat
          description: Signature type category.
          example: fileformat
        subtype:
          type: string
          description: Signature subtype (e.g., virus, trojan, exploit).
          example: custom
        severity:
          type: string
          enum:
          - critical
          - high
          - medium
          - low
          - informational
          example: informational
        description:
          type: string
          description: Human-readable description of the threat.
          example: Suspicious detected Security policy applied network network applied firewall.
        cve:
          type: array
          items:
            type: string
          description: Associated CVE identifiers.
          example:
          - example-cve_item
          - example-cve_item
        default_action:
          type: string
          enum:
          - alert
          - allow
          - drop
          - reset-both
          - reset-client
          - reset-server
          - block-ip
          - sinkhole
          description: Default action applied to traffic matching this signature.
          example: reset-client
        min_version:
          type: string
          description: Minimum PAN-OS version supporting this signature.
          example: 10.0.1
        max_version:
          type: string
          description: Maximum PAN-OS version supporting this signature (empty if still active).
          example: 5.1.5
        status:
          type: string
          enum:
          - released
          - deprecated
          - disabled
          example: released
        ori_release_version:
          type: string
          description: Content version in which this signature was first released.
          example: 3.0.5
        latest_release_version:
          type: string
          description: Most recent content version that updated this signature.
          example: 5.7.0
        first_release_time:
          type: string
          format: date-time
          description: Timestamp when the signature was first released.
          example: '2025-11-23T03:19:43Z'
        latest_release_time:
          type: string
          format: date-time
          description: Timestamp of the most recent signature update.
          example: '2024-07-12T01:32:30Z'
        sha256:
          type: array
          items:
            type: string
          description: SHA-256 hashes associated with this signature (antivirus).
          example:
          - example-sha256_item
          - example-sha256_item
    ThreatList:
      type: object
      properties:
        success:
          type: boolean
          example: true
        data:
          type: object
          properties:
            zingbox:
              type: array
              items:
                $ref: '#/components/schemas/ThreatSignature'
              example:
              - id: 675
                name: Primary Sensor 96
                type: fileformat
                subtype: custom
                severity: informational
                description: Suspicious detected Security policy applied network network applied firewall.
                cve: &id001
                - example-cve_item
                - example-cve_item
                default_action: reset-client
                min_version: 10.0.1
                max_version: 5.1.5
                status: released
                ori_release_version: 3.0.5
                latest_release_version: 5.7.0
                first_release_time: '2025-11-23T03:19:43Z'
                latest_release_time: '2024-07-12T01:32:30Z'
                sha256: &id002
                - example-sha256_item
                - example-sha256_item
              - id: 675
                name: Primary Sensor 96
                type: fileformat
                subtype: custom
                severity: informational
                description: Suspicious detected Security policy applied network network applied firewall.
                cve: *id001
                default_action: reset-client
                min_version: 10.0.1
                max_version: 5.1.5
                status: released
                ori_release_version: 3.0.5
                latest_release_version: 5.7.0
                first_release_time: '2025-11-23T03:19:43Z'
                latest_release_time: '2024-07-12T01:32:30Z'
                sha256: *id002
          example:
            zingbox:
            - id: 675
              name: Primary Sensor 96
              type: fileformat
              subtype: custom
              severity: informational
              description: Suspicious detected Security policy applied network network applied firewall.
              cve: *id001
              default_action: reset-client
              min_version: 10.0.1
              max_version: 5.1.5
              status: released
              ori_release_version: 3.0.5
              latest_release_version: 5.7.0
              first_release_time: '2025-11-23T03:19:43Z'
              latest_release_time: '2024-07-12T01:32:30Z'
              sha256: *id002
        count:
          type: integer
          description: Total number of matching signatures.
          example: 508
        total:
          type: integer
          example: 403
        offset:
          type: integer
          example: 515
        limit:
          type: integer
          example: 625
    ErrorResponse:
      type: object
      properties:
        success:
          type: boolean
          example: false
        message:
          type: string
          description: Human-readable error message.
          example: Threat applied violation endpoint activity violation activity incident applied.
        error_code:
          type: string
          description: Machine-readable error code.
          example: example-error_code
    ThreatHistoryList:
      type: object
      properties:
        success:
          type: boolean
          example: false
        data:
          type: array
          items:
            $ref: '#/components/schemas/ThreatHistoryEntry'
          example:
          - id: 915
            name: Branch Agent 35
            version: 4.1.4
            release_time: '2026-12-25T01:36:47Z'
            action: deprecated
          - id: 915
            name: Branch Agent 35
            version: 4.1.4
            release_time: '2026-12-25T01:36:47Z'
            action: deprecated
        total:
          type: integer
          example: 799
        offset:
          type: integer
          example: 559
        limit:
          type: integer
          example: 217
    ThreatHistoryEntry:
      type: object
      description: A historical record of a signature version.
      properties:
        id:
          type: integer
          example: 915
        name:
          type: string
          example: Branch Agent 35
        version:
          type: string
          description: Content version number for this history entry.
          example: 4.1.4
        release_time:
          type: string
          format: date-time
          example: '2026-12-25T01:36:47Z'
        action:
          type: string
          enum:
          - added
          - modified
          - deprecated
          example: deprecated
  responses:
    Forbidden:
      description: Insufficient API key permissions or quota exceeded.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid API key.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Malformed request or invalid query parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: An internal server error occurred.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.