MELTr
Home Vendors Search Download
Login
Vendors / Palo Alto Networks / WildFire / WildFire Threat Detection
Palo Alto Networks logo

Event type

WildFire Threat Detection

Advanced malware analysis and threat intelligence events

WildFire threat detection events including malware analysis results, threat classification, and file reputation

CSV 12 fields High Generator

malware threat-intelligence file-analysis wildfire security
Preview Sample View Schema
CLI Install
meltr templates install paloalto

Overview

What this event covers

WildFire threat detection events generated when files are analyzed and classified as malicious by Palo Alto's cloud-based threat intelligence service. The .j2 emits a full threat-log CSV row; documentation.fields below documents the primary operator-facing subset for registry UI, not every CSV column.

When generated

  • ›When files are submitted to WildFire for analysis
  • ›Upon completion of static and dynamic malware analysis
  • ›When threat verdicts are returned from WildFire cloud
  • ›During file reputation lookups for known threats

Security relevance

Critical

Compliance

NIST Cybersecurity Framework MITRE ATT&CK ISO 27001 SOC 2

Frequency notes

Moderate frequency during business hours when file downloads and email attachments are common

Resources

Docs and tools

WildFire Administrator Guide official Threat Prevention Best Practices official PAN-OS Log Field Reference official WildFire Portal Web interface for file analysis and threat intelligence AutoFocus Contextual threat intelligence platform

Generation

Configuration

Base frequency
25 events/hour
Time patterns
business_hours night_hours weekend
Business hours
1.5x
Night hours
0.8x
Weekend
0.6x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

threat_type
String Required

Category of threat detected by WildFire analysis

Source: threat_types | random

Example ransomware
Values
  • virus Traditional malware including trojans, worms, and viruses
  • spyware Information stealing malware and keyloggers
  • vulnerability Exploit attempts targeting known vulnerabilities
  • command-and-control C2 communication and botnet activity
  • ransomware File encryption and extortion malware
severity
String Required

Threat severity level assigned by WildFire

Source: Calculated based on threat_type

Example critical
Values
  • informational Low-impact or suspicious but not confirmed malicious
  • low Minor threat with limited impact potential
  • medium Moderate threat requiring attention
  • high Significant threat requiring immediate action
  • critical Severe threat with high impact potential
filename
String Required

Name of analyzed file including extension

Source: Dynamic generation based on threat type

Example invoice_a8b9c2d1.pdf
file_hash
String Required

SHA-256 hash of analyzed file

Source: random_string(64, '0123456789abcdef')

Format 64-character hexadecimal
Example a1b2c3d4e5f67890abcdef1234567890abcdef1234567890abcdef1234567890
signature_id
String Required

Unique signature identifier from WildFire

Source: Generated with timestamp and random number

Format Vendor:Date:ID
Example PaloAltoNetworks:20250526:12345
threat_description
String Required

Detailed description of threat behavior and characteristics

Source: threat_descriptions[threat_type] | random

Example WF-Ransom.PDF-JS BlackCat Ransomware variant detected
source_ip
IP Address Required

Internal IP address of host that triggered analysis

Source: registry.get_random_device().ip_address

Example 192.168.1.100
dest_ip
IP Address Required

External IP address contacted by malware

Source: random_public_ip()

Example 185.220.101.42
dest_country
String Required

Country associated with destination IP

Source: countries | random

Example Russia
session_id
Integer Required

Unique session identifier for the connection

Source: random_int(10000, 999999)

Example 542318
user
String Required

Username associated with the threat event

Source: registry.get_random_user().username

Example jdoe
timestamp
DateTime Required

Event timestamp in MM/DD/YYYY HH:MM:SS format

Source: current_timestamp() | format_timestamp('%Y/%m/%d %H:%M:%S')

Format YYYY/MM/DD HH:MM:SS
Example 2025/05/26 14:30:15