Palo Alto Networks · Capability

Palo Alto Networks Threat Intelligence

Unified threat intelligence capability for researching IOCs, submitting malware samples, analyzing DNS threats, and tracking security advisories across Threat Vault, WildFire, DNS Security, and Security Advisories.

Run with Naftiko Palo Alto NetworksThreat IntelligenceMalware AnalysisIOC ResearchVulnerability Management

What You Can Do

GET
Get threats — Search for threats by type, ID, SHA256, name, CVE, or date range.
/v1/threats
GET
Get threat history — Get the history of a specific threat by ID and type.
/v1/threats/{threat_id}/history
GET
Get atp reports — Get Advanced Threat Prevention reports.
/v1/atp-reports
GET
Get atp report pcaps — Get packet captures from ATP reports.
/v1/atp-reports/pcaps
GET
Get release notes — Get release notes for threat content updates.
/v1/release-notes
GET
Get threat vault stats — Get Threat Vault usage statistics.
/v1/threat-vault-stats
POST
Submit file — Submit a file for WildFire analysis.
/v1/samples/files
POST
Submit url — Submit a URL for WildFire analysis.
/v1/samples/urls
POST
Submit link — Submit a link for WildFire analysis.
/v1/samples/links
POST
Get verdict — Get the verdict for a file hash.
/v1/verdicts
POST
Get bulk verdicts — Get verdicts for multiple file hashes (max 500).
/v1/verdicts/bulk
POST
Get analysis report — Get the analysis report for a file hash.
/v1/analysis-reports
POST
Download sample — Download a sample file by hash.
/v1/analysis-reports/samples
POST
Get analysis pcap — Get packet capture for a file hash.
/v1/analysis-reports/pcaps
GET
Get domain — Get threat intelligence for a specific domain.
/v1/domains
GET
Get domain bulk — Get threat intelligence for multiple domains.
/v1/domains/bulk
GET
Get dns stats — Get DNS network statistics for a given time range.
/v1/dns-stats
GET
List advisories — List security advisories with optional filtering by severity and affected product.
/v1/advisories
GET
Get advisory — Get details of a specific security advisory by ID.
/v1/advisories/{advisory_id}
GET
Get advisory by cve — Get a security advisory by its CVE identifier.
/v1/advisories/cve/{cve_id}
GET
List affected products — List all products affected by security advisories.
/v1/affected-products

MCP Tools

search-threat-signatures

Search for threat signatures by type, ID, SHA256, name, CVE, or date range in Threat Vault.

read-only idempotent
get-threat-history

Get the history of a specific threat signature by ID and type from Threat Vault.

read-only idempotent
get-atp-reports

Get Advanced Threat Prevention reports from Threat Vault.

read-only idempotent
download-atp-pcaps

Download packet captures from ATP reports in Threat Vault.

read-only idempotent
get-release-notes

Get release notes for threat content updates from Threat Vault.

read-only idempotent
get-threat-vault-stats

Get Threat Vault API usage statistics.

read-only idempotent
submit-file-for-analysis

Submit a file for WildFire malware analysis.

submit-url-for-analysis

Submit a URL for WildFire malware analysis.

submit-link-for-analysis

Submit a link for WildFire malware analysis.

get-verdict

Get the WildFire verdict for a file hash.

read-only idempotent
get-bulk-verdicts

Get WildFire verdicts for multiple file hashes (max 500).

read-only idempotent
get-analysis-report

Get the WildFire analysis report for a file hash.

read-only idempotent
download-sample

Download a malware sample file by hash from WildFire.

read-only idempotent
download-pcap

Download a packet capture for a file hash from WildFire.

read-only idempotent
lookup-domain

Get DNS threat intelligence for a specific domain.

read-only idempotent
bulk-lookup-domains

Get DNS threat intelligence for multiple domains in bulk.

read-only idempotent
get-dns-network-stats

Get DNS network statistics for a given time range.

read-only idempotent
list-security-advisories

List Palo Alto Networks security advisories with optional filtering by severity and affected product.

read-only idempotent
get-security-advisory

Get details of a specific Palo Alto Networks security advisory by ID.

read-only idempotent
get-advisory-by-cve

Get a Palo Alto Networks security advisory by its CVE identifier.

read-only idempotent
list-affected-products

List all Palo Alto Networks products affected by security advisories.

read-only idempotent

Who This Is For

👤
Threat Intelligence Analyst
Researches threat actors, malware campaigns, and vulnerability trends.
👤
Malware Researcher
Analyzes suspicious files and samples for malware characteristics.

APIs Used

threat-vault wildfire dns-security security-advisory