Meraki API call to Palo Alto Wildfire

[choclateer]

A customer wants to integrate his Meraki APs to his Palo Alto Wildfire. Has anyone done this before?

[CptnCrnch]

How should integration look like?

I've never done this and don't know how Wildfire handles things, but the only way for outgoing calls on Meraki side would be Webhooks.

The other option is having Wildfire pull stuff via Meraki API, but that'd be inbound.

[choclateer]

We only have an RFP to date, haven't actually called them, but they are asking for all files downloaded by their network clients be automatically sent to Wildfire. (They have a Meraki network, switches and wireless.) Wildfire is Palo Alto's version of a Malware detector in the cloud, kind of equivalent to Cisco's AMP PxGrid.

[Nash]

Oh, dang. That doesn't sound like something you can do with webhooks or the Meraki API. To the best of my knowledge, neither of those things have any access to files downloaded onto the network.

The integrated AMP in the MX would have access, and you could send files to ThreatGrid with a subscription. But I don't think you're going to integrate this with a PAN product like you want.