demisto · bakatzir · Jan 5, 2021 · Jan 4, 2021 · Jan 4, 2021 · Jan 4, 2021
diff --git a/Packs/PaloAltoNetworks_Threat_Vault/Integrations/Threat_Vault/README.md b/Packs/PaloAltoNetworks_Threat_Vault/Integrations/Threat_Vault/README.md
@@ -384,8 +384,12 @@ Check IP location.
 
 | **Path** | **Type** | **Description** |
 | --- | --- | --- |
-| IP.Address | unknown | The IP address. | 
-| IP.Geo.Country | unknown | The country of the IP address. | 
+| IP.Address | String | The IP address. | 
+| IP.Geo.Country | String | The country of the IP address. | 
+| DBotScore.Vendor | String | The vendor used to calculate the score. | 
+| DBotScore.Score | Number | The actual score. | 
+| DBotScore.Type | String | The indicator type. | 
+| DBotScore.Indicator | String | The indicator that was tested. | 
 
 
 #### Command Example

diff --git a/Packs/PaloAltoNetworks_Threat_Vault/Integrations/Threat_Vault/Threat_Vault.py b/Packs/PaloAltoNetworks_Threat_Vault/Integrations/Threat_Vault/Threat_Vault.py
@@ -180,7 +180,8 @@ def file_command(client: Client, args: Dict) -> List[CommandResults]:
                 sha256=sha256,
                 dbot_score=dbot_score
             )
-            readable_output = tableToMarkdown(name=f"SHA256 {sha256} Antivirus reputation:", t=response, removeNull=True)
+            readable_output = tableToMarkdown(name=f"SHA256 {sha256} Antivirus reputation:", t=response,
+                                              removeNull=True)
         except Exception as err:
             if 'Error in API call [404] - Not Found' in str(err):
                 response = {}
@@ -453,7 +454,7 @@ def antispyware_signature_search(client: Client, args: dict) -> CommandResults:
     )
 
 
-def signature_search_results(client: Client, args: dict) -> CommandResults:
+def signature_search_results(client: Client, args: dict):
     """Retrieve signature search results.
 
     Args:
@@ -466,27 +467,32 @@ def signature_search_results(client: Client, args: dict) -> CommandResults:
     search_request_id = str(args.get('search_request_id', ''))
     search_type = str(args.get('search_type', ''))
 
-    response = client.signature_search_results_request(search_type, search_request_id)
-
-    outputs = response
-    outputs.update({'search_request_id': search_request_id})
-    if response.get('status') == 'submitted':  # search was not completed
-        readable_output = f'Search {search_request_id} is still in progress.'
-    else:
-        headers = ['signatureId', 'signatureName', 'domainName', 'cve', 'signatureType', 'status', 'category',
-                   'firstReleaseTime', 'latestReleaseTime']
-        outputs.update({'status': 'completed'})
-        title = f'Signature search are showing {outputs.get("page_count")} of {outputs.get("total_count")} results:'
-        readable_output = tableToMarkdown(name=title, t=outputs.get('signatures'),
-                                          headers=headers, removeNull=True)
+    try:
+        response = client.signature_search_results_request(search_type, search_request_id)
 
-    return CommandResults(
-        outputs_prefix=f'{client.name}.Search',
-        outputs_key_field='search_request_id',
-        outputs=outputs,
-        readable_output=readable_output,
-        raw_response=response
-    )
+        outputs = response
+        outputs.update({'search_request_id': search_request_id})
+        if response.get('status') == 'submitted':  # search was not completed
+            readable_output = f'Search {search_request_id} is still in progress.'
+        else:
+            headers = ['signatureId', 'signatureName', 'domainName', 'cve', 'signatureType', 'status', 'category',
+                       'firstReleaseTime', 'latestReleaseTime']
+            outputs.update({'status': 'completed'})
+            title = f'Signature search are showing {outputs.get("page_count")} of {outputs.get("total_count")} results:'
+            readable_output = tableToMarkdown(name=title, t=outputs.get('signatures'),
+                                              headers=headers, removeNull=True)
+        return CommandResults(
+            outputs_prefix=f'{client.name}.Search',
+            outputs_key_field='search_request_id',
+            outputs=outputs,
+            readable_output=readable_output,
+            raw_response=response
+        )
+    except Exception as err:
+        if 'Not Found' in str(err):
+            return_warning(f'Search request ID {search_request_id} was not found.')
+        else:
+            raise
 
 
 def test_module(client: Client, *_) -> str:

diff --git a/Packs/PaloAltoNetworks_Threat_Vault/Integrations/Threat_Vault/Threat_Vault.yml b/Packs/PaloAltoNetworks_Threat_Vault/Integrations/Threat_Vault/Threat_Vault.yml
@@ -206,8 +206,22 @@ script:
     outputs:
     - contextPath: IP.Address
       description: The IP address.
+      type: String
     - contextPath: IP.Geo.Country
       description: The country of the IP address.
+      type: String
+    - contextPath: DBotScore.Vendor
+      description: The vendor used to calculate the score.
+      type: String
+    - contextPath: DBotScore.Score
+      description: The actual score.
+      type: Number
+    - contextPath: DBotScore.Type
+      description: The indicator type.
+      type: String
+    - contextPath: DBotScore.Indicator
+      description: The indicator that was tested.
+      type: String
   - arguments:
     - default: false
       description: The signature name to search.
@@ -357,7 +371,7 @@ script:
     - contextPath: ThreatVault.Searchf.signatures
       description: A list of all the signatures found for this specific search.
       type: Unknown
-  dockerimage: demisto/python3:3.8.6.12176
+  dockerimage: demisto/python3:3.9.1.14969
   isfetch: false
   longRunning: false
   longRunningPort: false

diff --git a/Packs/PaloAltoNetworks_Threat_Vault/ReleaseNotes/1_0_2.md b/Packs/PaloAltoNetworks_Threat_Vault/ReleaseNotes/1_0_2.md
@@ -0,0 +1,6 @@
+
+#### Integrations
+##### Palo Alto Networks Threat Vault
+- Handle errors in the command ***threatvault-signature-search-results*** gracefully. 
+- Added missing outputs in the ***ip*** command.
+- Upgraded the docker image to: *demisto/python3:3.9.1.14969*.
diff --git a/Packs/PaloAltoNetworks_Threat_Vault/pack_metadata.json b/Packs/PaloAltoNetworks_Threat_Vault/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "Palo Alto Networks Threat Vault",
     "description": "Use the Palo Alto Networks Threat Vault to research the latest threats (vulnerabilities/exploits, viruses, and spyware) that Palo Alto Networks next-generation firewalls can detect and prevent.",
     "support": "xsoar",
-    "currentVersion": "1.0.1",
+    "currentVersion": "1.0.2",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",
@@ -12,11 +12,16 @@
     ],
     "tags": [],
     "useCases": [],
-    "keywords": ["logs", "antispyware", "antivirus", "pan-os"],
+    "keywords": [
+        "logs",
+        "antispyware",
+        "antivirus",
+        "pan-os"
+    ],
     "dependencies": {
         "CommonScripts": {
             "mandatory": true,
             "display_name": "Common Scripts"
         }
     }
-}
+}