Aide-mémoire de l’API Threat Vault
7470
Created On 08/22/22 10:37 AM - Last Modified 08/21/25 11:08 AM
Objective
Fournir un guide rapide sur les commandes les plus couramment utilisées pour l’API Threat Vault.
Environment
Threat Vault API
Procedure
Avant de commencer :
Comment obtenir votre clé API Threat Vault
Requêtes
ID de la menace :
curl -v -H 'X-API-KEY: <APIKEY>' 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?id=<Threat_ID>'
MD5 :
curl -v -H 'X-API-KEY: <APIKEY>' 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?md5=<MD5_HASH>'
SHA256:
curl -v -H 'X-API-KEY: <APIKEY>' 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?sha256=<SHA256_HASH>'
Nom de la signature :
curl -v -H 'X-API-KEY: <APIKEY>' 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?name=<Signature+Name or Group+of+words>'
- Les requêtes comportant plusieurs mots doivent utiliser + à la place des espaces, exemple : commande+et+contrôle
CVE :
curl -v -H 'X-API-KEY: <APIKEY>' 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?CVE=<CVE-XXXX-XXX or CVE-XXXX>'
Date:
curl -v -H 'X-API-KEY: <APIKEY>' 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?releaseDate=<DATE>'
curl -v -H 'X-API-KEY: <APIKEY>' 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?fromReleaseDate=<FROMDATE>&toReleaseDate=<TODATE>'
Version du contenu :
curl -v -H 'X-API-KEY: <APIKEY>' 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?releaseVersion=<VERSION>'
curl -v -H 'X-API-KEY: <APIKEY>' 'https://api.threatvault.paloaltonetworks.com/service/v1/threats?&fromReleaseVersion=<FROMVERSION>&toReleaseVersion=<TOVERSION>'
Historique des signatures, package antivirus :
curl -v -H 'X-API-KEY: <APIKEY>' 'https://api.threatvault.paloaltonetworks.com/service/v1/threats/history?id=<Threat_ID>&type=antivirus'
- Remarque : disponible uniquement pour les signatures libérées, non disponible pour les signatures remplacées ou désactivées
Historique de la signature, ensemble WildFire :
curl -v -H 'X-API-KEY: <APIKEY>' 'https://api.threatvault.paloaltonetworks.com/service/v1/threats/history?id=<Threat_ID>&type=wildfire'
- Remarque : disponible uniquement pour les signatures libérées, non disponible pour les signatures remplacées ou désactivées
Requêtes par lots
La limite pour les requêtes par lots est de 100 entrées par requête (les exemples affichent 3 entrées). Les requêtes par lots disponibles sont les suivantes :
ID de la menace :
curl -v -X POST -H 'X-API-KEY: <APIKEY>' -H 'Content-Type: application/json' -d '{"id":["<Threat_ID>","<Threat_ID>","<Threat_ID>"]}' 'https://api.threatvault.paloaltonetworks.com/service/v1/threats'
MD5 :
curl -v -X POST -H 'X-API-KEY: <APIKEY>' -H 'Content-Type: application/json' -d '{"md5":["<MD5_HASH>","<MD5_HASH>","<MD5_HASH>"]}' 'https://api.threatvault.paloaltonetworks.com/service/v1/threats'
SHA256:
curl -v -X POST -H 'X-API-KEY: <APIKEY>' -H 'Content-Type: application/json' -d '{"sha256":["<SHA256_HASH>","<SHA256_HASH>","<SHA256_HASH>"]}' 'https://api.threatvault.paloaltonetworks.com/service/v1/threats'
Nom de la signature :
curl -v -X POST -H 'X-API-KEY: <APIKEY>' -H 'Content-Type: application/json' -d '{"name":["<Signature+Name or Group+of+words>","<Signature+Name or Group+of+words>","<Signature+Name or Group+of+words>"]}' 'https://api.threatvault.paloaltonetworks.com/service/v1/threats'
- Les requêtes comportant plusieurs mots doivent utiliser + à la place des espaces, exemple : commande+et+contrôle
Additional Information