Autofocus - File Indicators Hunting Deprecated

id: Autofocus - File Indicators Hunting
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Autofocus - File Indicators Hunting
deprecated: true
description: "Deprecated. No available replacement. The playbook queries the PANW Autofocus session and samples log data for file indicators such as MD5, SHA256, and SHA1 hashes. \n\nA simple search mode is used to query Autofocus based on the file indicators specified in the playbook inputs. Advanced search mode queries can also be used with multiple query parameters, but require all field names, parameters, and operators (JSON format) to be specified. \nWe recommended using the Autofocus UI to create an advanced query, exporting it, and pasting it into the relevant playbook inputs. \n\nNote that multiple search values should be separated by commas only (without spaces or any special characters)."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: efd174b1-c3ae-48ce-8d14-52e397954612
    type: start
    task:
      id: efd174b1-c3ae-48ce-8d14-52e397954612
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "216"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1500,
          "y": 345
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "153":
    id: "153"
    taskid: 3ab00780-9973-4e65-8271-1f0d598b5fbd
    type: title
    task:
      id: 3ab00780-9973-4e65-8271-1f0d598b5fbd
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1500,
          "y": 1130
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "216":
    id: "216"
    taskid: 0370eaaa-158d-4e7b-892e-2d775ec0e9c3
    type: condition
    task:
      id: 0370eaaa-158d-4e7b-892e-2d775ec0e9c3
      version: -1
      name: Any file hash to hunt for?
      description: Checks whether there are any file hashes available for searching.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "153"
      "yes":
      - "221"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.FileHash
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1500,
          "y": 480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "221":
    id: "221"
    taskid: ea34de11-75f6-42c9-844e-2137532ea54a
    type: title
    task:
      id: ea34de11-75f6-42c9-844e-2137532ea54a
      version: -1
      name: Search File Hashes
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "227"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1050,
          "y": 650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "227":
    id: "227"
    taskid: 5eff5255-3ad4-4fe0-86dc-c2c7726b26b8
    type: playbook
    task:
      id: 5eff5255-3ad4-4fe0-86dc-c2c7726b26b8
      version: -1
      name: Autofocus Query Samples, Sessions and Tags
      description: |-
        This playbook queries the PANW Threat Intelligence Autofocus system. The playbook accepts indicators such as IPs, hashes, and domains to run basic queries or advanced queries that can leverage several query parameters.
        To run the more advanced queries we recommended using the Autofocus UI https://autofocus.paloaltonetworks.com/#/dashboard/organization to create a query and then using the export search button. The result can be used as a playbook input.

        This playbook supports searching both the Samples API and the Sessions API.
      playbookName: Autofocus Query Samples, Sessions and Tags
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "233"
      - "234"
    scriptarguments:
      Commodity:
        complex:
          root: inputs.Commodity
      Hash:
        complex:
          root: inputs.FileHash
          transformers:
          - operator: toUpperCase
          - operator: split
            args:
              delimiter:
                value:
                  simple: ','
          - operator: uniq
      Sample first seen:
        complex:
          root: inputs.Sample first seen
      Sample last modified:
        complex:
          root: inputs.Sample last modified
      SampleQuery:
        complex:
          root: inputs
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.SampleQuery
                iscontext: true
          accessor: SampleQuery
      Scope:
        complex:
          root: inputs.Scope
          filters:
          - - operator: containsGeneral
              left:
                value:
                  simple: inputs.Scope
                iscontext: true
              right:
                value:
                  simple: industry
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: inputs.Scope
                iscontext: true
              right:
                value:
                  simple: organization
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: inputs.Scope
                iscontext: true
              right:
                value:
                  simple: global
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: inputs.Scope
                iscontext: true
              right:
                value:
                  simple: all
              ignorecase: true
      Search Type:
        complex:
          root: inputs.Search Type
          filters:
          - - operator: containsGeneral
              left:
                value:
                  simple: inputs.Search Type
                iscontext: true
              right:
                value:
                  simple: session
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: inputs.Search Type
                iscontext: true
              right:
                value:
                  simple: sample
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: inputs.Search Type
                iscontext: true
              right:
                value:
                  simple: tag
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: inputs.Search Type
                iscontext: true
              right:
                value:
                  simple: all
              ignorecase: true
      SessionQuery:
        complex:
          root: inputs.SessionQuery
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.SessionQuery
                iscontext: true
      Sessions time after:
        complex:
          root: inputs.Sessions time after
      Sessions time before:
        complex:
          root: inputs.Sessions time before
      Tags class:
        complex:
          root: inputs.Tags class
          filters:
          - - operator: containsGeneral
              left:
                value:
                  simple: inputs.Tags class
                iscontext: true
              right:
                value:
                  simple: Actor
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: inputs.Tags class
                iscontext: true
              right:
                value:
                  simple: Campaign
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: inputs.Tags class
                iscontext: true
              right:
                value:
                  simple: Exploit
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: inputs.Tags class
                iscontext: true
              right:
                value:
                  simple: Malicious Behavior
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: inputs.Tags class
                iscontext: true
              right:
                value:
                  simple: Malware Family
              ignorecase: true
      Tags private:
        complex:
          root: inputs.Tags private
      Tags public:
        complex:
          root: inputs.Tags public
      Tags scope:
        complex:
          root: inputs.Tags scope
          filters:
          - - operator: containsGeneral
              left:
                value:
                  simple: inputs.Tags scope
                iscontext: true
              right:
                value:
                  simple: industry
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: inputs.Tags scope
                iscontext: true
              right:
                value:
                  simple: organization
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: inputs.Tags scope
                iscontext: true
              right:
                value:
                  simple: global
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: inputs.Tags scope
                iscontext: true
              right:
                value:
                  simple: all
              ignorecase: true
      Unit 42:
        complex:
          root: inputs.Unit 42
      Wildfire Verdict:
        complex:
          root: inputs.wildfire_verdict
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.wildfire_verdict
                iscontext: true
          - - operator: containsGeneral
              left:
                value:
                  simple: inputs.wildfire_verdict
                iscontext: true
              right:
                value:
                  simple: Malware
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: inputs.wildfire_verdict
                iscontext: true
              right:
                value:
                  simple: Grayware
              ignorecase: true
            - operator: containsGeneral
              left:
                value:
                  simple: inputs.wildfire_verdict
                iscontext: true
              right:
                value:
                  simple: Benign
              ignorecase: true
            - operator: isEqualString
              left:
                value:
                  simple: inputs.wildfire_verdict
                iscontext: true
              right:
                value:
                  simple: Phishing
              ignorecase: true
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1050,
          "y": 785
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "233":
    id: "233"
    taskid: ada25639-fff8-4779-84e2-f5cd2ecc0bd7
    type: regular
    task:
      id: ada25639-fff8-4779-84e2-f5cd2ecc0bd7
      version: -1
      name: Save Matching Results - Sessions Search
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "153"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Autofocus.Sessions.HuntingResults
      value:
        complex:
          root: AutoFocus.SessionsResults
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: AutoFocus.SessionsResults.SHA256
                iscontext: true
          - - operator: notInList
              left:
                value:
                  simple: AutoFocus.SessionsResults.SHA256
                iscontext: true
              right:
                value:
                  simple: inputs.SHA256
                iscontext: true
              ignorecase: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 1270,
          "y": 955
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "234":
    id: "234"
    taskid: 399883e1-3bd8-492c-82dd-0c2548f1500a
    type: regular
    task:
      id: 399883e1-3bd8-492c-82dd-0c2548f1500a
      version: -1
      name: Save Matching Results - Samples Results
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "153"
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Autofocus.Samples.HuntingResults
      value:
        complex:
          root: AutoFocus.SamplesResults
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: AutoFocus.SamplesResults.MD5
                iscontext: true
            - operator: isNotEmpty
              left:
                value:
                  simple: AutoFocus.SamplesResults.SHA1
                iscontext: true
            - operator: isNotEmpty
              left:
                value:
                  simple: AutoFocus.SamplesResults.SHA256
                iscontext: true
          - - operator: notInList
              left:
                value:
                  simple: AutoFocus.SamplesResults.SHA256
                iscontext: true
              right:
                value:
                  simple: inputs.SHA256
                iscontext: true
              ignorecase: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 840,
          "y": 955
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 850,
        "width": 1040,
        "x": 840,
        "y": 345
      }
    }
  }
inputs:
- key: FileHash
  value: {}
  required: false
  description: "One or more file hashes to search for in Autofocus simple mode search. Supports MD5, SHA1, and SHA256 file hashes. \n\nSeparate multiple search values by commas only (without spaces or any special characters)."
  playbookInputQuery:
- key: Search Type
  value: {}
  required: true
  description: "Which Autofocus search types should be executed. \n\nPossible values are session, sample, tag, or all. Session and sample are the recommended search types for this playbook. \n\nSample-based search detects threat indicators or identifiers within samples sent to WildFire for analysis. \n\nSession-based search detects threat indicators or identifiers within various context details and session data provided by samples during sample submission. \n\nTag-based search identifies the most popular tags."
  playbookInputQuery:
- key: Scope
  value: {}
  required: true
  description: Search scope for sample and session. Possible values are industry, organization, global, or all.
  playbookInputQuery:
- key: SampleQuery
  value: {}
  required: false
  description: |-
    Use the Autofocus advanced search mode to leverage a variety of query options in a sample search. Advanced search requires you to specify all field names, parameters, and operators.

    The query currently supports only JSON format which can be extracted from the Autofocus web console API radio button.
  playbookInputQuery:
- key: Sample first seen
  value: {}
  required: false
  description: |-
    Narrow down a sample-based search by specifying the timestamp samples were first uploaded to WildFire for analysis (indicators will be searched within samples after this timestamp).

    Specify the time in ISO 8601 format, for example, 2019-09-12T00:00:00.
  playbookInputQuery:
- key: Sample last modified
  value: {}
  required: false
  description: |-
    Narrow down a sample-based search by specifying the timestamp samples were last modified (indicators will be searched within samples after this timestamp).

    Specify the time in ISO 8601 format, for example, 2019-09-12T00:00:00.
  playbookInputQuery:
- key: SessionQuery
  value: {}
  required: false
  description: |-
    Use the Autofocus advanced search mode to leverage a variety of query options in a session search. Advanced search requires you to specify all field names, parameters, and operators.

    The query currently supports only JSON format which can be extracted from the Autofocus web console API radio button.
  playbookInputQuery:
- key: Sessions time before
  value: {}
  required: false
  description: |-
    Narrow down a session-based search by specifying the query end timestamp (indicators will be searched within sessions before this timestamp).

    Specify the time in ISO 8601 format, for example, 2019-09-12T00:00:00.
  playbookInputQuery:
- key: Sessions time after
  value: {}
  required: false
  description: |-
    Narrow down a session-based search by specifying the query start timestamp (indicators will be searched within sessions after this timestamp).

    Specify the time in ISO 8601 format, for example, 2019-09-12T00:00:00.
  playbookInputQuery:
- key: Wildfire Verdict
  value: {}
  required: false
  description: "Filter results by WildFire classification assigned to samples based on properties, behaviors, and activities observed for files or email links during static and dynamic analysis.\n\nPossible values are malware, benign, phishing, and greyware. "
  playbookInputQuery:
outputs:
- contextPath: Autofocus.Samples.HuntingResults
  description: Sample objects containing relevant fields.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.Created
  description: The date the file was created.
  type: date
- contextPath: Autofocus.Samples.HuntingResults.Finished
  description: The date the file was finished.
  type: date
- contextPath: Autofocus.Samples.HuntingResults.FileName
  description: The name of the file.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.FileType
  description: The file type.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.SHA1
  description: The SHA1 hash of the file.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.SHA256
  description: The SHA256 hash of the file.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.MD5
  description: The MD5 hash of the file.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.Region
  description: The region of the sample.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.Tags
  description: The tags attached to the sample.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.TagGroups
  description: The groups of relevant tags.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.Verdict
  description: The verdict of the sample.
  type: number
- contextPath: Autofocus.Samples.HuntingResults.Artifact.confidence
  description: The decision confidence.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.Artifact.indicator
  description: The indicator that was tested.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.Artifact.indicator_type
  description: 'The indicator type, for example: Mutex, User agent, IPv4, Domain.'
  type: string
- contextPath: Autofocus.Samples.HuntingResults.Artifact.b
  description: How many set the artifact as benign.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.Artifact.g
  description: How many set the artifact as grayware.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.Artifact.m
  description: How many set the artifact as malicious.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults
  description: Session objects containing relevant fields.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.Seen
  description: The seen date.
  type: date
- contextPath: Autofocus.Sessions.HuntingResults.UploadSource
  description: The source of the uploaded sample.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.ID
  description: The ID of the session. Used to get session details.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.FileName
  description: The name of the file.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.FileURL
  description: The URL of the file.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.SHA256
  description: The SHA256 hash of the file.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.Industry
  description: The related industry.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.Region
  description: The regions of the sessions.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.Tags
  description: The relevant tags.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.app
  description: The associated application name.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.dst_ip
  description: The associated destination IP.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.src_ip
  description: The associated source IP.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.dst_countrycode
  description: The associated destination country code.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.src_countrycode
  description: The associated source country code.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.dst_port
  description: The associated destination port number.
  type: number
- contextPath: Autofocus.Sessions.HuntingResults.src_port
  description: The associated source port number.
  type: number
- contextPath: Autofocus.Sessions.HuntingResults.user_id
  description: The recipient user ID.
  type: string
tests:
- No tests (auto formatted)
fromversion: 6.5.0
supportedModules:
- agentix
- xsiam