Palo Alto Threat Intelligence

The integration ensures that customers can prioritize which threats are relevant to their organization. ThreatConnect threat intelligence provides relevant context about the type and level of threat to Palo Alto Networks’ firewalls to automatically alert or block. The benefits of this integration are:

• Drives multi-sourced, normalized and correlated threat intelligence from the ThreatConnect Platform into Palo Alto NGFW.
• Allows jobs in Palo Alto NGFW to automatically alert or block based on the indicator’s tags or threat rating in ThreatConnect.
• Develop intelligence-driven alerting and blocklists based on data from ThreatConnect.
• Enables AE's threat intelligence to work in real-time by automatically blocking IPs & URLs in Palo Alto NGFW.

The following actions are available to manage threat intelligence in Palo Alto Networks:

• Deploy Domains: This action deploys a domain(s).
• Deploy IPs: This action deploys an ip(s).
• Delete Domains: This action deletes a domain(s).
• Delete Ips: This action deletes an ip(s).

This app can be found in the ThreatConnect App Catalog under the name: Palo Alto Networks NGFW.

This Palo Alto Wildfire Playbook App allows you to submit Files for sandbox analysis and retrieve analysis results. In addition to sandboxing, the app lets users retrieve enrichment information for Address, Host, URL, and File IOCs.

The following actions are available to use machine learning and crowdsourced Palo Alto threat intelligence to:

• Analyze File
• Get File Enrichment
• Get Address Enrichment
• Get Host Enrichment
• Get URL Enrichment
• Get File Analysis Results
• Advanced Request

This app can be found in the ThreatConnect App Catalog under the name: Palo Alto Wildfire