This document explains how to configure the Palo Alto Networks Panorama v1.0.0 plugin with the Threat Exchange module of the Netskope Cloud Exchange platform. The Palo Alto Networks Panorama plugin fetches information about domains, IP addresses, file hashes (SHA256) from Wildfire logs, and URLs from URL Filtering logs.
Prerequisites
To complete this configuration, you need:
- A Netskope tenant (or multiple, for example, production and development/test instances).
- A Netskope Cloud Exchange tenant with the Tenant plugin and Threat Exchange plugin already configured.
- Palo Alto Networks Panorama platform credentials.
- Connectivity to the following host: Palo Alto Networks Panorama instance. For example: https://<your-panorama-domain>.
Panorama Plugin Support
The Palo Alto Networks Panorama plugin is used to fetch SHA256 file hashes from Wildfire logs, and URLs from URL Filtering logs. This plugin does not support sharing of IoCs to Palo Alto Networks Panorama.
| Fetched indicator types | Shared indicator types |
|---|---|
| SHA256, URLs | Not Supported |
Mappings
Pull Mappings
| Netskope CE Fields | Palo Alto Networks Panorama Fields |
|---|---|
| value | file hashes from Wildfire logs (SHA256) OR URLs from URL Filtering logs(URLs) |
| type | type |
| firstSeen | first_timestamp |
| lastSeen | last_timestamp |
| Severity | severity |
| tags | tags |
| comments | Filename: misc data from response |
Note: The comments are present only for indicator of type filehases(SHA256)
Permissions
The API Key needs to have XML API permissions available to pull the indicators. Follow this official document of the panorama platform to give permission to your user.
API Details
List of APIs Used
| API Endpoint | Method | Use Case |
|---|---|---|
| /api | GET |
|
Get job id to fetch the logs
API Endpoint: BASE_URL/api
Method: GET
Request Params
| Key | Value |
|---|---|
| key | Api-key |
| type | type |
| log_type | Wildfire (For Malware) OR Url (For URL) |
| query | (time_generated geq ‘<last_run_time>’) |
| nlogs | 5000 |
| dir | forward |
Sample API Response
{
"response": {
"@status": "success",
"@code": "19",
"result": {
"msg": {
"line": "query job enqueued with jobid 160"
},
"job": "160"
}
}
}
Pull indicators from Wildfire and URLs
API Endpoint: BASE_URL/api
Method: GET
Request Params
| Key | Value |
|---|---|
| key | Api-key |
| type | type |
| action | get |
| job-id | job-id |
Sample API Response
{
"response": {
"@status": "success",
"result": {
"job": {
"tenq": "23:56:16",
"tdeq": "23:56:16",
"tlast": "16:00:00",
"status": "ACT",
"id": "165",
"cached-logs": "0"
},
"log": {
"logs": {
"@count": "0",
"@progress": "0"
}
}
}
}
}
Workflow
- Create an Admin Role with the Required Permissions.
- Create an Admin User.
- Get your API Key
- Configure the Panorama plugin
- Validate the Panorama plugin.
Click play to watch a video.
Get your Panorama Base URL and API Key
Create an Admin Role Profile with the Required Permissions
In the Web UI, enable the following options:
- Monitor
- Logs
- URL Filtering
- WildFire Submissions
In the XML API, enable the following options:
- Log
- Configuration
No other permissions are required, so you can disable all other options.
Refer to these screenshots for reference:
When finished, click OK.
Create an Admin User
After the profile is created, go to Panorama > Administrators and create a new admin user.
- Select Custom Panorama Admin as the Administrator Type.
- Under the Profile section, choose the Admin Role created in the previous step.
- Click OK.
Here’s a screenshot for reference:
Get your API Key
To configure the plugin, you will need an API Key. You can retrieve it by following the steps outlined in the Panorama documentation: Get Your API Key.
Configure the Palo Alto Networks Panorama Plugin
- In Cloud Exchange, go to Settings > Plugins.
- Search for and select the Palo Alto Networks Panorama box.
- Enter the basic information:
- Configuration Name: Unique name for the configuration.
- Sync Interval: Leave Default.
- Aging Criteria: Leave Default.
- Override Reputation: Leave Default.
- Tags Aggregate Strategy: Choose whether to append new tags to existing IoC(s) or overwrite them. This configuration parameter determines how tags are stored for indicators pulled for this configuration.
- Enable SSL verification: Enable if SSL verification is required for communication.
- Use System Proxy: Enable if the proxy is required for communication.
- Click Next.
- Enter the configuration parameters:
- Base URL: The Base URL is the Panorama device’s IP address or Domain name, like https://<your-panorama-domain>.
- API Key: The API keys on the firewall and Panorama enable you to authenticate API calls to the XML API and REST API.
- Type of Threat data: Select Type of Threat Data. Select Malware if you want to pull only file hashes, or URL if you want to pull only URLs, and select Both if you want to pull both.
- Initial Range (in days): Number of days to pull the data for the initial run.
- Click Save.
- Now plugin is configured and you’ll see plugin configuration in Threat Exchange > Plugins.
Configure a Threat Exchange Business Rule for Panorama
To share indicators fetched from the Palo Alto Networks Panorama to the Netskope CE, you will need to have a business rule that will filter out the indicators that you want to share. To configure a business rule follow the below steps:
- In Threat Exchange, go to Business Rules and click Create New Rule.
- Add the filters according to your requirements in the rule, and then click Save.
Configure Sharing for Panorama
To share IoCs from the Palo Alto Networks Panorama to the Cloud Exchange:
- In Threat Exchange, go to Sharing and click Add Sharing Configuration.
- Select your Source Configuration (CTE Palo Alto Networks Panorama), a Business Rule, the Destination Configuration (CTE Netskope), and a Target.
- Click Save.
Validate the Palo Alto Networks Panorama Plugin
Validate the Pull
To verify the data available for pulling on Palo Alto Networks Panorama:
- Log in to your Panorama instance.
- Go to Monitor > Wildfire Submissions.
You are fetching file hashes from this page. So if these logs appear over here, then indicators will be pulled in Cloud Exchange.
- Go to Monitor > URL Filtering.
You are fetching URLs from this page. So, if logs are available in this page, then it will be fetched as an indicator in Cloud Exchange.
Troubleshooting the Panorama Plugin
Unable to pull IoCs from the Palo Alto Networks Panorama platform
After the plugin configuration if the IoCs are not pulled from the platform it might be due to one of the following.
- No IoCs are available on the platform to pull
- IoCs are not available for the given time range or do not match the configuration parameters.
What to do: Identity your root cause from above and follow below steps to resolve the issue.
No IoCs are available on the platform to pull
Check if the IoCs are available on the platform to pull. If available, check the resolution for the next point.
IOCs are not available for the given time range
If the IoCs are available on the platform to pull, but the plugin has not pulled the IoCs in Cloud Exchange, check the number of days mentioned in the initial range parameter of the plugin configuration. On the Palo Alto Networks Panorama platform, check if you have data for the given time range.
If the data is still available for the given time range it might be possible that the IoCs for the provided filter (Malware, URL) in the plugin configuration are not available, so check the values from the plugin configuration parameter, and filter the same on the Palo Alto Networks Panorama platform.
Unable to configure the Palo Alto Networks Panorama plugin
It might be due to one of the following:
- Invalid Base URL
- Inavalid API key
What to do: Identify the root cause and follow the steps for the specified issue.
Invalid Base URL
Refer to the Prerequisites section and ensure your Palo Alto Networks Panorama instance is working properly.
Invalid API key
Refer to the Get your API Key section to get the valid API Key for your Palo Alto Networks Panorama instance.
Limitation
We only support pulling 100k indicators as of now, which takes around 2 and a half hours to pull, and then a few more hours to store in Cloud Exchange. If the data to be pulled is greater than 100k, you might start to see some performance issues in Cloud Exchange, like data taking too long to be fetched, Cloud Exchange taking time to respond, etc. This issue will be fixed in the next release of Cloud Exchange.