Skip to main content

Request Threat Signature Metadata in Batch Mode​

A POST request to retrieve the threats signature metadata by id, name or sample hash (sha256 or md5) in batch mode. Batch limit is 100 entries.

  • Notes:
    • Optionally, each query parameter can be used together with the "type" query parameter to filter out the results.
    • Any Antivirus / WildFire release summary information before February 2020 is best-effort since the information is not available.
Request Body required
  • id string[]

    Provides the threat signatures metadata by exact match of the signature ids.

    curl -v -X POST -H 'X-API-KEY: API_KEY' \
      -H 'Content-Type: application/json' \
      -d '{"id": ["280392504"]}' \
      'https://api.threatvault.paloaltonetworks.com/service/v1/threats'
  • md5 string[]

    Provides the file information and threat signatures that match the hash of the sample.

    curl -v -X POST -H 'X-API-KEY: API_KEY' \
      -H 'Content-Type: application/json' \
      -d '{"md5": ["ca066f965dfbc5392871d3fa281236cf"]}' \
      'https://api.threatvault.paloaltonetworks.com/service/v1/threats'
  • name string[]

    Provides the threat signatures metadata by exact match of the signature names.

    curl -v -X POST -H 'X-API-KEY: API_KEY' \
      -H 'Content-Type: application/json' \
      -d '{"name": ["Microsoft PE File"]}' \
      'https://api.threatvault.paloaltonetworks.com/service/v1/threats'
  • sha256 string[]

    Provides the file information and threat signatures that match the hash of the sample.

    curl -v -X POST -H 'X-API-KEY: API_KEY' \
      -H 'Content-Type: application/json' \
      -d '{"sha256": ["7879722cd37b1c5b2703ea5a1a92a036a96f4a1fc6272b92c197b3a4b17267cc"]}' \
      'https://api.threatvault.paloaltonetworks.com/service/v1/threats'
  • type string

    Possible values: [ips, fileformat, spyware, vulnerability, antivirus, dns, rtdns, spywarec2]

    Provides the threat signature metadata based on the threat type. Use together with the other fields to filter out the results.

    ⚠️ Use without quotes

    • Options:
      • antivirus (Provides Antivirus signatures metadata)
      • dns (Provides DNS signatures metadata)
      • fileformat (Provides all IPS File-Format signature metadata)
      • ips (Provides all IPS signature metadata)
      • rtdns (Provides Real-Time DNS Detection entries metadata)
      • spyware (Provides all IPS Anti-Spyware signature metadata)
      • spywarec2 (Provides Spyware C2 signatures metadata)
      • vulnerability (Provides all IPS Vulnerability Protection signature metadata)
    curl -v -X POST -H 'X-API-KEY: API_KEY' \
      -H 'Content-Type: application/json' \
      -d '{"id": ["280392504"], "type":"antivirus"}' \
      'https://api.threatvault.paloaltonetworks.com/service/v1/threats'
Responses

Request succeeded

Response Headers
  • X-Day-RateLimit-Limit integer
    Example: 2000

    The maximum number of requests that the user is permitted to make per day.

  • X-Day-RateLimit-Remaining integer

    The number of requests remaining in the current rate limit window (one day).

  • X-Day-RateLimit-Reset integer

    The epoch timestamp at which the current rate limit window (one day) resets.

  • X-Minute-RateLimit-Limit integer
    Example: 200

    The maximum number of requests that the user is permitted to make per minute.

  • X-Minute-RateLimit-Remaining integer

    The number of requests remaining in the current rate limit window (one minute).

  • X-Minute-RateLimit-Reset integer

    The epoch timestamp at which the current rate limit window (one minute) resets.

Schema
  • count integer

    The total number of entries found.

  • data object[]

    The data of the response.

  • Array [
  • antivirus object[]

    List of Antivirus signatures.

  • Array [
  • id string

    The unique threat signature id.

  • name string

    The threat signature name.

  • severity string

    The threat signature severity. List: low, informative, medium, high or critical

  • type string

    A numerical value describing the type of the threat signature.

  • subtype string

    The threat signature subtype.

  • action string

    The threat signature default action. This is generally empty for Antivirus signatures.

  • description string

    The threat signature description.

  • create_time string

    The threat signature creation time.

  • status string

    The threat signature creation time. List: active or inactive

  • related_sha256_hashes string[]

    The list of related sha256 hashes for the threat signature.

  • release object

    The threat signature release information.

  • antivirus object

    The threat signature information related to Antivirus package updates.

  • first_release_version string

    The release version when the threat signature was first released with Antivirus package.

  • first_release_time string

    The release time when the threat signature was first released with Antivirus package.

  • last_release_version string

    The release version when the threat signature was last released with Antivirus package.

  • last_release_time string

    The release time when the threat signature was last released with Antivirus package.

  • wildfire object

    The threat signature information related to WildFire package updates.

  • first_release_version string

    The release version when the threat signature was first released with WildFire package.

  • first_release_time string

    The release time when the threat signature was first released with WildFire package.

  • last_release_version string

    The release version when the threat signature was last released with WildFire package.

  • last_release_time string

    The release time when the threat signature was last released with WildFire package.

  • ]
  • ]
  • link object[]

    The pagination information of the results.

  • Array [
  • next string

    The URL of previous page with results.

  • previous string

    The URL of next page with results.

  • ]
  • message string

    Generic response message.

  • success boolean

    The response status.

Loading...