Autofocus Deprecated

Deprecated. Use the Palo Alto Networks AutoFocus v2 integration instead. Palo Alto Networks AutoFocus enables you to distinguish the most important threats from everyday commodity attacks.

Data Enrichment & Threat Intelligence · AutoFocus by Palo Alto Networks

Details

IDAutofocus
ProviderPalo Alto Networks
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Supported ModulesAgentix Cortex Cloud Cloud Runtime Security Cloud Posture Security XSIAM EDR

README

AutoFocus contextual threat intelligence brings speed, consistency and precision to threat investigation.

Configure Autofocus on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Autofocus.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • Server URL
    • Version
    • API Key
    • Use system proxy settings
    • Trust any certificate (not secure)
  4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. Search for samples: autofocus-search-samples
  2. Search for sessions: autofocus-search-sessions
  3. Get details of a session: autofocus-session
  4. Get a sample analysis: autofocus-sample-analysis
  5. Get the reputation of a file: file

1. Search for samples

Search for samples in Palo Alto Networks AutoFocus.

Base Command

autofocus-search-samples

Input
Argument Name Description Required
scope The scope for the search Optional
size Number of results Optional
from Sample number to start from Optional
sort Sort field Optional
order Order of sort Optional
query The query to retrieve samples Required
sleep Time to sleep between checking for results Optional
checks Number of checks before giving up on the query Optional
cookie The af_cookie for retrieving previous search results Optional

 

Context Output
Path Type Description
Autofocus.Cookie string The cookie for the results
Autofocus.Samples.id string The ID of the sample.
Autofocus.Samples.md5 string The MD5 hash of the sample.
Autofocus.Samples.sha1 string The SHA-1 of the sample.
Autofocus.Samples.sha256 string The SHA-256 of the sample.
Autofocus.Samples.app_name string The application name (if exists).
Autofocus.Samples.size number The size of the sample.
Autofocus.Samples.ssdeep string The SSDeep of the sample.
Autofocus.Samples.create_date string The create date for the sample.
Autofocus.Samples.finish_date string The finish date for the sample.
Autofocus.Samples.malware string Is this malware (0 or 1).
Autofocus.Samples.app_packagename string The sample package name (if exists).
Autofocus.Samples.filetype string The sample type.
Autofocus.Samples.region number Where this sample was seen.
Autofocus.Samples.tag string The tags of the sample.

 

Command Example

!autofocus-search-samples scope="public" size="10" sort="create_date" order="desc" query="{\"operator\": \"all\", \"children\": [{\"field\": \"sample.malware\", \"operator\": \"is\", \"value\": 1}]}"

Human Readable Output

autof_search_samples

2. Search for sessions

Search for sessions in Palo Alto Networks AutoFocus.

Base Command

autofocus-search-sessions

Input
Argument Name Description Required
size The number of results to return. Optional
from The sample number to start from. Optional
sort The sort field. Optional
order The sort order. Optional
query The query to retrieve samples. Required
sleep The time to sleep between checking for results. Optional
checks The number of checks before stopping the query. Optional
cookie The af_cookie for retrieving previous search results. Optional

 

Context Output
Path Type Description
Autofocus.Cookie string The cookie for the results.
Autofocus.Sessions.id string The ID of the session.
Autofocus.Sessions.device_industry string The device industry.
Autofocus.Sessions.filename string The name of the file.
Autofocus.Sessions.region string The region for the session.
Autofocus.Sessions.sha256 string The SHA-256 of the file.
Autofocus.Sessions.tstamp string The timestamp for the session.
Autofocus.Sessions.upload_src string Where did we get the file

 

Command Example

!autofocus-search-sessions size="10" sort="tstamp" order="desc" query="{\"operator\": \"all\", \"children\": [{\"field\": \"session.region\", \"operator\": \"is\", \"value\": \"us\"}]}"

Human Readable Output

autof_search_sessios

3. Get details of a session

Returns details of a specific session.

Base Command

autofocus-session

Input
Argument Name Description Required
id The session ID to retrieve details for. Required

 

Context Output
Path Type Description
Autofocus.Sessions.id string The ID of the session.
Autofocus.Sessions.device_industry string The device industry.
Autofocus.Sessions.filename string The name of the file.
Autofocus.Sessions.region string The region for the session.
Autofocus.Sessions.sha256 string The SHA-256 of the file.
Autofocus.Sessions.tstamp string The timestamp for session.
Autofocus.Sessions.upload_src string The origin of the file.

 

4. Get a sample analysis

Retrieves the sample analysis.

Base Command

autofocus-sample-analysis

Input
Argument Name Description Required
id The ID of the sample. Required
coverage Whether coverage should be displayed. Optional
sections A CSV list of sections to display: apk_app_icon, apk_app_name, apk_cert_file, apk_certificate_id, apk_defined_activity, apk_defined_intent_filter, apk_defined_receiver, apk_defined_sensor, apk_defined_service, apk_digital_signer, apk_embedded_library, apk_embeded_url, apk_internal_file, apk_isrepackaged, apk_packagename, apk_requested_permission, apk_sensitive_api_call, apk_suspicious_behavior, apk_suspicious_file, apk_suspicious_pattern, apk_suspicious_action_monitored, apk_suspicious_file, apk_suspicious_string, apk_version_num, behavior_type, connection, coverage, dns, file, http, japi, mac_embedded_url, misc, mutex, process, registry, service, user_agent Optional
platforms A CSV list of platforms: win7, winxp, android, staticAnalyzer, mac Optional

 

Context Output

There is no context output for this command.

Command Example

!autofocus-sample-analysis id="7ebf30b8f908ce574fda70af1f94ebcb071c2e5f0e22f2ec349a2290f243a036" coverage=true sections=file

Human Readable Output

autof_sample_analysis

5. Get the reputation of a file

Checks the file reputation of the given hash.

Base Command

file

Input
Argument Name Description Required
file The hash of the file to query. Supports MD5, SHA-1, and SHA-256. Required

 

Context Output
Path Type Description
File.MD5 string The MD5 hash of the file.
File.SHA1 string The SHA-1 hash of the file.
File.SHA256 string The SHA-256 hash of the file.
File.Malicious.Vendor string For malicious files, the vendor that made the decision.
File.Malicious.Description string For malicious files, the reason that the vendor made the decision.
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
DBotScore.Description string The reason for the score (if any).

 

Command Example

!file file="75779e62f9790bd4c2ed449bd20be741f78811fb5ce848a2c5a516af17cdeccf" using-brand="Autofocus"

Human Readable Output

autof_file

Configuration parameters

  • server — Server URL (required)
  • version — Version (required)
  • apiKey — API Key (required)
  • useproxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)

Commands (5)

  • autofocus-sample-analysis

    Retrieve the sample analysis

  • autofocus-search-samples

    Search for samples on Autofocus

  • autofocus-search-sessions

    Search for sessions on Autofocus

  • autofocus-session

    Get details of a specific session

  • file

    Check file reputation of the given hash

Source

Autofocus.js Autofocus.yml Autofocus_description.md
Download History Raw 
commonfields:
  id: Autofocus
  version: -1
name: Autofocus
display: Palo Alto AutoFocus (Deprecated)
deprecated: true
category: Data Enrichment & Threat Intelligence
provider: Palo Alto Networks
description: Deprecated. Use the Palo Alto Networks AutoFocus v2 integration instead. Palo Alto Networks AutoFocus enables you to distinguish the most important threats from everyday commodity attacks.
configuration:
- display: Server URL
  name: server
  defaultvalue: https://autofocus.paloaltonetworks.com/
  type: 0
  required: true
- display: Version
  name: version
  defaultvalue: v1.0
  type: 0
  required: true
- display: API Key
  name: apiKey
  defaultvalue: ""
  type: 4
  required: true
- display: Use system proxy settings
  name: useproxy
  defaultvalue: "true"
  type: 8
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: "false"
  type: 8
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: autofocus-search-samples
    arguments:
    - name: scope
      auto: PREDEFINED
      predefined:
      - private
      - public
      - global
      description: The scope for the search
      defaultValue: public
    - name: size
      description: Number of results
      defaultValue: "50"
    - name: from
      description: Sample number to start from
      defaultValue: "0"
    - name: sort
      auto: PREDEFINED
      predefined:
      - app_name
      - app_packagename
      - filetype
      - size
      - finish_date
      - create_date
      - update_date
      - md5
      - sha1
      - sha256
      - ssdeep
      description: Sort field
    - name: order
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: Order of sort
    - name: query
      required: true
      description: The query to retrieve samples
    - name: sleep
      description: Time to sleep between checking for results
      defaultValue: "3"
    - name: checks
      description: Number of checks before giving up on the query
      defaultValue: "10"
    - name: cookie
      description: The af_cookie for retrieving previous search results
    outputs:
    - contextPath: Autofocus.Cookie
      description: The cookie for the results
      type: string
    - contextPath: Autofocus.Samples.id
      description: ID of sample
      type: string
    - contextPath: Autofocus.Samples.md5
      description: MD5 of the sample
      type: string
    - contextPath: Autofocus.Samples.sha1
      description: SHA1 of the sample
      type: string
    - contextPath: Autofocus.Samples.sha256
      description: SHA256 of the sample
      type: string
    - contextPath: Autofocus.Samples.app_name
      description: Application name (if exists)
      type: string
    - contextPath: Autofocus.Samples.size
      description: The size of the sample
      type: number
    - contextPath: Autofocus.Samples.ssdeep
      description: SSDeep of the sample
      type: string
    - contextPath: Autofocus.Samples.create_date
      description: The create date for the sample
      type: string
    - contextPath: Autofocus.Samples.finish_date
      description: The finish date for the sample
      type: string
    - contextPath: Autofocus.Samples.malware
      description: A flag (0/1) if this is malware
      type: string
    - contextPath: Autofocus.Samples.app_packagename
      description: The sample package name (if exists)
      type: string
    - contextPath: Autofocus.Samples.filetype
      description: The sample type
      type: string
    - contextPath: Autofocus.Samples.region
      description: Where have we seen this sample
      type: number
    - contextPath: Autofocus.Samples.tag
      description: Sample tags
      type: string
    description: Search for samples on Autofocus
  - name: autofocus-search-sessions
    arguments:
    - name: size
      description: Number of results
      defaultValue: "50"
    - name: from
      description: Sample number to start from
      defaultValue: "0"
    - name: sort
      auto: PREDEFINED
      predefined:
      - app
      - device_country
      - device_countrycode
      - device_hostname
      - device_serial
      - vsys
      - dst_country
      - dst_countrycode
      - dst_ip
      - dst_port
      - emailsbjcharset
      - device_industry
      - src_country
      - src_countrycode
      - src_ip
      - src_port
      - sha256
      - tstamp
      - upload_src
      description: Sort field
    - name: order
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      description: Order of sort
    - name: query
      required: true
      description: The query to retrieve samples
    - name: sleep
      description: Time to sleep between checking for results
      defaultValue: "3"
    - name: checks
      description: Number of checks before giving up on the query
      defaultValue: "10"
    - name: cookie
      description: The af_cookie for retrieving previous search results
    outputs:
    - contextPath: Autofocus.Cookie
      description: The cookie for the results
      type: string
    - contextPath: Autofocus.Sessions.id
      description: ID of the session
      type: string
    - contextPath: Autofocus.Sessions.device_industry
      description: Device industry
      type: string
    - contextPath: Autofocus.Sessions.filename
      description: The name of the file
      type: string
    - contextPath: Autofocus.Sessions.region
      description: Region for the session
      type: string
    - contextPath: Autofocus.Sessions.sha256
      description: SHA256 of the file
      type: string
    - contextPath: Autofocus.Sessions.tstamp
      description: Timestamp for session
      type: string
    - contextPath: Autofocus.Sessions.upload_src
      description: Where did we get the file
      type: string
    description: Search for sessions on Autofocus
  - name: autofocus-session
    arguments:
    - name: id
      required: true
      default: true
      description: The session ID to retrieve details for
    outputs:
    - contextPath: Autofocus.Sessions.id
      description: ID of the session
      type: string
    - contextPath: Autofocus.Sessions.device_industry
      description: Device industry
      type: string
    - contextPath: Autofocus.Sessions.filename
      description: The name of the file
      type: string
    - contextPath: Autofocus.Sessions.region
      description: Region for the session
      type: string
    - contextPath: Autofocus.Sessions.sha256
      description: SHA256 of the file
      type: string
    - contextPath: Autofocus.Sessions.tstamp
      description: Timestamp for session
      type: string
    - contextPath: Autofocus.Sessions.upload_src
      description: Where did we get the file
      type: string
    description: Get details of a specific session
  - name: autofocus-sample-analysis
    arguments:
    - name: id
      required: true
      default: true
      description: The sample id
    - name: coverage
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Should we display coverage
      defaultValue: "true"
    - name: sections
      description: 'comma-separated list of sections to display: apk_app_icon, apk_app_name, apk_cert_file, apk_certificate_id, apk_defined_activity, apk_defined_intent_filter, apk_defined_receiver, apk_defined_sensor, apk_defined_service, apk_digital_signer, apk_embedded_library, apk_embeded_url, apk_internal_file, apk_isrepackaged, apk_packagename, apk_requested_permission, apk_sensitive_api_call, apk_suspicious_behavior, apk_suspicious_file, apk_suspicious_pattern, apk_suspicious_action_monitored, apk_suspicious_file, apk_suspicious_string, apk_version_num, behavior_type, connection, coverage, dns, file, http, japi, mac_embedded_url, misc, mutex, process, registry, service, user_agent'
      defaultValue: file
    - name: platforms
      description: 'comma-separated list of platforms: win7, winxp, android, staticAnalyzer, mac'
    description: Retrieve the sample analysis
  - name: file
    arguments:
    - name: file
      required: true
      default: true
      description: Hash of the file to query. Supports MD5, SHA1 and SHA256.
    outputs:
    - contextPath: File.MD5
      description: File MD5 hash
      type: string
    - contextPath: File.SHA1
      description: File SHA1 hash
      type: string
    - contextPath: File.SHA256
      description: File SHA256 hash
      type: string
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision
      type: string
    - contextPath: File.Malicious.Description
      description: For malicious files, the reason for the vendor to make the decision
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator we tested
      type: string
    - contextPath: DBotScore.Type
      description: The type of the indicator
      type: string
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the Score
      type: string
    - contextPath: DBotScore.Score
      description: The actual score
      type: number
    - contextPath: DBotScore.Description
      description: The reason for the score (if any)
      type: string
    description: Check file reputation of the given hash
tests:
- No tests
fromversion: 5.0.0