Palo Alto Networks WildFire

The OpenCTI Palo Alto Networks WildFire enrichment connector enriches StixFile and Artifact observables with WildFire file verdicts. For each observable it queries the WildFire public API by hash (MD5/SHA-1/SHA-256) and, when the hash is unknown and a file is attached, submits the file for analysis and polls for the verdict. It maps the WildFire verdict (benign, grayware, phishing, malware, command-and-control) to an OpenCTI score and label, completes the file hashes from the WildFire report, and attaches a STIX Malware Analysis object with the WildFire result. The connector is playbook compatible and always returns the enriched bundle.