AutoFocus Daily Feed Deprecated

Deprecated. No available replacement.

Data Enrichment & Threat Intelligence · AutoFocus by Palo Alto Networks · Feed

Details

IDAutoFocus Daily Feed
ProviderPalo Alto Networks
CategoryData Enrichment & Threat Intelligence
From Version5.5.0
Docker Imagedemisto/python3:3.10.1.25933
Supported ModulesAgentix Cortex Cloud Cloud Runtime Security Cloud Posture Security XSIAM EDR

README

Deprecated. use the AutoFocus Feed integration instead.
Use the AutoFocus Feeds integration to fetch indicators from AutoFocus.
For more information click here.
TIM customers that upgraded to version 6.2 or above, can have the API Key pre-configured in their main account so no additional input is needed. To use this feature, upgrade your license so it includes the license key.

Configure AutoFocus Feed in Cortex

Parameter Description Required
feed The fetch indicators. False
api_key API Key. False
feedReputation The indicator reputation. False
feedReliability The source’s reliability. True
tlp_color The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed. More information about the protocol can be found at https://us-cert.cisa.gov/tlp False
feedExpirationPolicy The feed’s expiration policy. False
feedExpirationInterval The interval after which the feed expires. False
feedFetchInterval The feed fetch interval. False
feedBypassExclusionList Whether to bypass exclusion list. False
override_default_credentials Override default credentials False
insecure Whether to trust any certificate (not secure). False
proxy Whether to use the system proxy settings. False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Get Indicators

Gets the indicators from AutoFocus.

Note: This command does not create indicators within Cortex XSOAR.

Base Command

autofocus-daily-get-indicators

Input
Argument Name Description Required
limit The maximum number of indicators to return. The default value is 10. Optional
offset The index of the first indicator to fetch. Optional
Context Output

There is no context output for this command.

Command Example

!autofocus-daily-get-indicators limit=4

Human Readable Output

Indicators from AutoFocus

Value Type
demsito<Span>.com Domain
{file hash} File
8.8.8.8 IP
demsito<Span>.com/some/aditional/path URL

To bring the next batch of indicators run:
!autofocus-daily-get-indicators limit=4 offset=4

Configuration parameters

  • feed — Fetch indicators
  • api_key — API Key
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability (required)
  • tlp_color — Traffic Light Protocol Color
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • feedIncremental — Incremental Feed
  • feedFetchInterval — Feed Fetch Interval
  • feedBypassExclusionList — Bypass exclusion list
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • feedTags — Tags

Commands (1)

  • autofocus-daily-get-indicators

    Gets indicators from AutoFocus.

Source

FeedAutofocusDaily.py FeedAutofocusDaily_test.py FeedAutofocusDaily.yml FeedAutofocusDaily_description.md
Download History Raw 
## AutoFocus Feed
Gets Daily Threat Feed from AutoFocus.

For more information see the [AutoFocus documentation](https://docs.paloaltonetworks.com/autofocus/autofocus-admin/autofocus-feeds.html).