AutoFocusPolling

Use this playbook as a sub-playbook to query PANW Autofocus Threat intelligence system. This sub-playbook is the same as the generic polling sub-playbook besides that it provides outputs in the playbook. The reason for that is that in Autofocus its impossible to query the results of the same query more than once so the outputs have to be in the polling context. This playbook implements polling by continuously running the command in Step \#2 until the operation completes. The remote action should have the following structure: 1. Initiate the operation. 2. Poll to check if the operation completed. 3. (optional) Get the results of the operation.

Pack

AutoFocus

Tasks

6

Inputs

• Ids — List of IDs to poll
• PollingCommandName — Name of the polling command to run
• PollingCommandArgName — Argument name of the polling command.
• Interval — Frequency that the polling command will run (minutes).
• Timeout — Amount of time to poll before declaring a timeout and resuming the playbook (in minutes).
• dt — DT filter for polling IDs. Polling will stop when no results are returned. Use single quotes, e.g WildFire.Report(val.Status!==''Success'').SHA256.
• AdditionalPollingCommandArgNames — Names of additional arguments for the polling command, e.g (arg1,arg2,...).'
• AdditionalPollingCommandArgValues — Values of the additional arguments for the polling command, e.g (value1,value2,...).

Outputs

• AutoFocus.SessionsResults — Results of Autofocus sessions search.
• AutoFocus.SamplesResults — Results of Autofocus sample search.
• AutoFocus.TopTagResults — Results of Autofocus tags search