Autofocus Query Samples, Sessions and Tags

Deprecated. No available replacement. This playbook is used for querying the PANW threat intelligence Autofocus system. The playbook accepts indicators such as IP's, hashes, domains to run basic queries or mode advanced queries that can leverage several query parameters. In order to run the more advanced queries its recommended to use the Autofocus UI https://autofocus.paloaltonetworks.com/#/dashboard/organization to created a query and than use the export search button. The result can be used as a playbook input. The playbook supports searching both the Samples API and the sessions API.

Pack

AutoFocus

Tasks

15

Inputs

• Scope — Scope can be Private Public Global
• SampleQuery — Query needs to be provided in order to determine what to search for. Query is currently only in JSON format which can be extracted from the Autofocus web console API radio button. Query example for searching hashes can be {"operator":"any","children":[{"field":"sample.sha256","operator":"is","value":"4f79697b40d0932e91105bd496908f8e02c130a0e36f6d3434d6243e79ef82e0"},{"field":"sample.sha256","operator":"is","value":"7e93723c0c34ef98444e5ce9013fef220975b96291a79053fd4c9b3d3550aeb3"}]} Another example for searching for an IP {"operator":"any","children":[{"field":"sample.src_ip","operator":"is","value":"1.1.1.1"},{"field":"sample.dst_ip","operator":"is","value":"1.1.1.1"},{"field":"sample.src_ip","operator":"is","value":"2.2.2.2"},{"field":"sample.dst_ip","operator":"is","value":"2.2.2.2"}]}
• SessionQuery — Query needs to be provided in order to determine what to search for. Query is currently only in JSON format which can be extracted from the Autofocus web console API radio button. Query example for searching hashes can be {"operator":"any","children":[{"field":"session.sha256","operator":"is","value":"4f79697b40d0932e91105bd496908f8e02c130a0e36f6d3434d6243e79ef82e0"},{"field":"session.sha256","operator":"is","value":"7e93723c0c34ef98444e5ce9013fef220975b96291a79053fd4c9b3d3550aeb3"}]} Another example for searching for an IP {"operator":"any","children":[{"field":"session.src_ip","operator":"is","value":"1.1.1.1"},{"field":"session.dst_ip","operator":"is","value":"1.1.1.1"},{"field":"session.src_ip","operator":"is","value":"2.2.2.2"},{"field":"session.dst_ip","operator":"is","value":"2.2.2.2"}]}
• IP — IP to query
• Hash — Hash to query
• URL — URL to query
• Domain — Domain to query
• Search Type — Values can be session, sample, tag,all
• Wildfire Verdict — Values can be Malware,Benign,Phishing,Greyware
• Sessions time before — Timestamp in the following format 2019-09-12T00:00:00 This parameter checks for sessions prior to this timestamp
• Sessions time after — Timestamp in the following format 2019-09-12T00:00:00 This parameter checks for sessions after this timestamp
• Sample first seen — Timestamp in the following format 2019-09-12T00:00:00 This parameter checks for when the sample was first seen after this date.
• Sample last modified — Timestamp in the following format 2019-09-12T00:00:00 This parameter checks for when the sample was last modified after this date.
• Tags scope — Values can be industry, organization, all, global.
• Tags class — Values can be Actor, Campaign, Exploit, Malicious Behavior, Malware Family
• Tags private — Values can be True, False. If true the search will only focus on private (non public) objects. Default is false
• Tags public — Values can be True, False. If true the search will only focus on public (non private) objects. Default is false.
• Commodity — Values can be True, False. Default is false.
• Unit 42 — Values can be True, False. Default is false objects that have been analyzed by Palo Alto's Unit 42 global threat intelligence team.

Outputs

• AutoFocus.SessionsResults — Results of Autofocus sessions search.
• AutoFocus.SamplesResults — Results of Autofocus samples search.
• AutoFocus.TopTagResults — Results of Autofocus tags search.

Commands used

• autofocus-search-samples
• autofocus-search-sessions
• autofocus-top-tags-search