Get WildFire Data Enrichment Flow
When the Security Operations Palo Alto Networks - Get WildFire Data Enrichment flow is executed, a hash file is uploaded to WildFire. The data is enriched, and reports are downloaded to the instance to aid in processing potential malware attacks.
Before you begin
Role required: sn_si.analyst
About this task
The Security Operations Palo Alto Networks - Get WildFire Data Enrichment flow is executed when a security incident is created from an alert received from the Palo Alto Network Firewall application. A malware hash from the email notification received from Firewall is entered on the IoC tab of the security incident, and the record is updated.
Procedure
Navigate to All > Security Incident > Show Open Incidents.
Based on the email notification received from Firewall, locate and open the security incident that was created.
Select the Indicators of Compromise tab and populate the Malware hash with the hash you received in the alert.
Select Update.
The flow causes the hash file to be uploaded to WildFire where the data is enriched. Reports in the PDF and XML formats are attached to the record (security incident or IoC) in your instance to aid in processing potential malware attacks.
Note: If the enriched data includes packet capture information, PCAP information is also downloaded. PCAP data captures what actions the file was performing. For example, it can report on what servers the file was contacting. To view PCAP files, you need a packet analyzer, such as Wireshark.
Sample PDF report
WildFire- get PCAP action
The WildFire: Get PCAP flow action gets the packet capture (PCAP) information generated during the analysis of a specified file hash on WildFire. The result of this action is attached to a specific record as identified by the TableName and RecordId.
Input variables
Input variables determine the initial behavior of the action.
| Variable | Description |
|---|---|
| FileSHA256Hash [string] | The hash of the file received from the Palo Alto Network Firewall application. |
| TableName [string] | The affected table. |
| RecordId [string] | The security incident or IoC being updated. |
Output variables
The output variables contain data that can be used in subsequent actions.
| Variable | Description |
|---|---|
| commandStatus [Boolean] | True if a result is obtained and attached successfully. |
| errorMessage | The error, if any, that occurred in the action. |
WildFire- get PDF report action
The WildFire: Get PDF Report flow action gets the report generated during the analysis of a specified file hash on WildFire in PDF format. The result of this action is attached to a specific record as identified by the TableName and RecordId.
Input variables
Input variables determine the initial behavior of the action.
| Variable | Description |
|---|---|
| TableName [string] | The affected table. |
| FileSHA256Hash [string] | The hash of the file received from the Palo Alto Network Firewall application. |
| RecordId [string] | The security incident or IoC being updated. |
Output variables
The output variables contain data that can be used in subsequent actions.
| Variable | Description |
|---|---|
| commandStatus [Boolean] | True if a result is obtained and attached successfully. |
| errorMessage | The error, if any, that occurred in the action. |
WildFire- get XML report action
The WildFire: Get XML Report flow action gets the report generated during the analysis of a specified file hash on WildFire in XML format. The result of this action is attached to a specific record as identified by the TableName and RecordId.
Input variables
Input variables determine the initial behavior of the action.
| Variable | Description |
|---|---|
| TableName [string] | The affected table. |
| FileSHA256Hash [string] | The hash of the file received from the Palo Alto Network Firewall application. |
| RecordId [string] | The security incident or IoC being updated. |
Output variables
The output variables contain data that can be used in subsequent actions.
| Variable | Description |
|---|---|
| commandStatus [Boolean] | True if a result is obtained and attached successfully. |
| errorMessage | The error, if any, that occurred in the action. |