Palo Alto Networks now provides improved URL analysis capabilities for all WildFire global and regional clouds, by delivering standardized web page verdicts and reports through the API, as well as enhanced malicious email link detection on the firewall. Not only does this generate a more accurate verdict by aggregating threat analysis details from all Palo Alto Networks services, but it also provides consistent URL analysis data, regardless of which Palo Alto Networks products you rely on to protect your network.

The URL analyzers operating in the WildFire global cloud processes URL feeds, correlated URL sources (such as email links), NRD (newly registered domain) lists, PAN-DB content, and manually uploaded URLs, to provide all WildFire clouds with the improved capabilities, without affecting GDPR compliance. After a URL has been processed, you can retrieve the WildFire URL analysis report, which includes the verdict, detection reasons with evidence, screenshots, and analysis data generated for the web request. You can also retrieve web page artifacts (downloaded files and screenshots) seen during URL analysis to further investigate anomalous activity. The new enhancements found in the URL analysis service enables WildFire to play a larger role in defending your network by supporting your SOC and incident response teams with more accurate verdicts and better visibility into URL analysis.

No additional configuration is necessary to take advantage of this feature, however, if you want to automatically submit email links for analysis (which are now analyzed through this service), you must configure your firewall to forward email links.

Verdicts that you suspect are either false positives or false negatives can be submitted to the Palo Alto Networks threat team for additional analysis.

You can use the WildFire API to retrieve URL analysis reports, verdicts, and related web artifacts. The following table describes the new and updated API endpoints that are now available.

<wildfire>
   <get-verdict-info>
      <url>http://www.google.com</url>
         <verdict>0</verdict>
         <analysis_time>2020-06-29T16:33:17Z</analysis_time>       
          <valid>Yes/valid>
   </get-verdict-info
</wildfire>								

{
  "success": true,
  "result": {
     "analysis_time": "2020-04-22:42:30Z",
     "url_type": "original",
     "report": "<MAEC report>"/"",
}