Merge pull request #1094 from joeslazaro-cdw/jl/wildfire-analyzer

Implement Palo Alto WildFire analyzer

analyzers/PaloAltoWildFire/Dockerfile

@@ -0,0 +1,6 @@
+FROM python:3.10-alpine
+WORKDIR /worker
+COPY requirements.txt PaloAltoWildFire/
+RUN pip3 install --no-cache-dir -r PaloAltoWildFire/requirements.txt
+COPY . PaloAltoWildFire
+ENTRYPOINT ["python3", "PaloAltoWildFire/wildfire.py"]

analyzers/PaloAltoWildFire/PaloAltoWildFire.json

@@ -0,0 +1,58 @@
+{
+  "name": "PaloAltoWildFire",
+  "version": "1.0",
+  "author": "Ignacio Rodriguez Paez, Joe Lazaro",
+  "url": "https://github.com/TheHive-Project/Cortex-Analyzers",
+  "license": "AGPL-V3",
+  "description": "Run Palo Alto WildFire analysis on a file, hash, or URL",
+  "dataTypeList": [
+    "file",
+    "url",
+    "hash"
+  ],
+  "command": "PaloAltoWildFire/wildfire.py",
+  "baseConfig": "PaloAltoWildFire",
+  "registration_required": true,
+  "subscription_required": true,
+  "free_subscription": false,
+  "service_homepage": "https://www.paloaltonetworks.com/network-security/wildfire",
+  "service_logo": {
+    "path": "assets/palo_alto_logo.png",
+    "caption": "logo"
+  },
+  "screenshots": [
+    {
+      "path": "assets/wildfire_file.png",
+      "caption": "WildFire file analysis long report sample"
+    },
+    {
+      "path": "assets/wildfire_url.png",
+      "caption": "WildFire URL analysis long report sample"
+    }
+  ],
+  "configurationItems": [
+    {
+      "name": "api_host",
+      "description": "You can send requests to the WildFire global cloud (U.S., default option) or to the WildFire regional clouds that Palo Alto Networks owns and maintains. See the WildFire Public Cloud documentation for a list of valid servers.",
+      "type": "string",
+      "multi": false,
+      "required": true,
+      "defaultValue": "wildfire.paloaltonetworks.com"
+    },
+    {
+      "name": "key",
+      "description": "API key for WildFire",
+      "type": "string",
+      "multi": false,
+      "required": true
+    },
+    {
+      "name": "polling_interval",
+      "description": "Define time interval between two requests attempts for the report",
+      "type": "number",
+      "multi": false,
+      "required": false,
+      "defaultValue": 60
+    }
+  ]
+}

analyzers/PaloAltoWildFire/README.md

@@ -0,0 +1,11 @@
+WildFire® is the industry's largest, most integrated cloud malware protection engine that utilizes patented machine learning models for real-time detection of previously unseen, targeted malware and advanced persistent threats, keeping your organization protected.
+
+When you submit observables to WildFire, they are analyzed in a sandboxed environment using multiple techniques:
+* Dynamic analysis observes the files as they execute
+* Machine learning extracts unique feathres form each file
+* Static analysis provides instant identification of malware variants
+* Uses a custom hypervisor to prevent malware evasion techniques
+
+This analyzer supports "file", "url", and "hash" observables to be submitted to WildFire and produces a nicely formatted report in TheHive with all the pertinent information.
+
+Product website: https://www.paloaltonetworks.com/network-security/wildfire

analyzers/PaloAltoWildFire/requirements.txt

@@ -0,0 +1,3 @@
+cortexutils
+requests
+xmltodict