Palo Alto Networks · Example Payload

Threat Vault Api Atp Report Example

Cloud SecurityCybersecurityFirewallNetwork SecuritySASESOARThreat IntelligenceXDR

Threat Vault Api Atp Report Example is an example object payload from Palo Alto Networks, with 6 top-level fields. It illustrates the shape of data this provider's APIs accept or return.

Top-level fields

idsha256statusverdictcreate_timereport

Example Payload

{
  "id": "example-id",
  "sha256": "4ef800504d926fa341c4f3b20cf34ddaf71565a86a25c54d16d9a98dbd991161",
  "status": "complete",
  "verdict": "phishing",
  "create_time": "2025-08-15T02:28:33Z",
  "report": {
    "file_type": "standard",
    "size": 823,
    "behaviors": [
      {
        "name": "Staging Scanner 62",
        "description": "Allowed malware configured traffic malware on.",
        "severity": "critical"
      },
      {
        "name": "Primary Agent 99",
        "description": "Detected incident and for allowed for detected and monitoring alert firewall suspicious firewall.",
        "severity": "high"
      }
    ],
    "network": {
      "dns_queries": [
        "example-dns_queries_item",
        "example-dns_queries_item"
      ],
      "http_requests": [
        "example-http_requests_item"
      ],
      "connections": [
        {
          "dst_ip": "97.228.188.178",
          "dst_port": 168,
          "protocol": "ICMP"
        },
        {
          "dst_ip": "76.208.6.34",
          "dst_port": 667,
          "protocol": "TCP"
        },
        {
          "dst_ip": "86.246.175.116",
          "dst_port": 80,
          "protocol": "ICMP"
        }
      ]
    }
  }
}