Autofocus - Hunting And Threat Detection Deprecated

id: Autofocus - Hunting And Threat Detection
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Autofocus - Hunting And Threat Detection
deprecated: true
description: "Deprecated. No available replacement. The playbook queries the PANW Autofocus session and samples log data for file and traffic indicators, such as SHA256, SHA1, MD5, IP addresses, URLs, and domains. \n\nA simple search mode queries Autofocus based on the indicators specified in the playbook inputs. Advanced queries can also use with multiple query parameters, but require all field names, parameters, and operators (JSON format) to be specified. \nWe recommended using the Autofocus UI to create an advanced query, exporting it, and pasting it into the relevant playbook inputs. \n\nNote that multiple search values should be separated by commas only (without spaces or any special characters)."
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: efd174b1-c3ae-48ce-8d14-52e397954612
    type: start
    task:
      id: efd174b1-c3ae-48ce-8d14-52e397954612
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "156"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 590,
          "y": -140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "153":
    id: "153"
    taskid: 3ab00780-9973-4e65-8271-1f0d598b5fbd
    type: title
    task:
      id: 3ab00780-9973-4e65-8271-1f0d598b5fbd
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 590,
          "y": 330
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "155":
    id: "155"
    taskid: a0015271-705b-4b2d-8d02-d09f2e3d4374
    type: playbook
    task:
      id: a0015271-705b-4b2d-8d02-d09f2e3d4374
      version: -1
      name: Autofocus - Traffic Indicators Hunting
      description: "Queries the PANW Threat Intelligence Autofocus system. Traffic indicators such as URLs, IP addresses, and domains can be used to run basic queries in the playbook. \nAdvanced search mode queries can also be used with multiple query parameters, but require all field names, parameters, and operators (JSON format) to be specified. \nWe recommended using the Autofocus UI to create an advanced query, exporting it, and pasting it into the relevant playbook inputs."
      playbookName: Autofocus - Traffic Indicators Hunting
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "153"
    scriptarguments:
      IPAddress:
        complex:
          root: inputs.IPAddress
      Sample first seen:
        complex:
          root: inputs.Sample first seen
      Sample last modified:
        complex:
          root: inputs.Sample last modified
      SampleQuery:
        complex:
          root: inputs.SampleQuery
      Scope:
        complex:
          root: inputs.Scope
      Search Type:
        complex:
          root: inputs.Search Type
      SessionQuery:
        complex:
          root: inputs.SessionQuery
      Sessions time after:
        complex:
          root: inputs.Sessions time after
      Sessions time before:
        complex:
          root: inputs.Sessions time before
      URLDomain:
        complex:
          root: inputs.URLDomain
      Wildfire Verdict:
        complex:
          root: inputs.Wildfire Verdict
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 830,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "156":
    id: "156"
    taskid: a42c1add-d6d0-43c0-85d3-a0768def4a46
    type: condition
    task:
      id: a42c1add-d6d0-43c0-85d3-a0768def4a46
      version: -1
      name: Is Autofocus enabled?
      description: Returns 'yes' if integration brand is available.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "153"
      "yes":
      - "155"
      - "158"
    scriptarguments:
      brandname:
        simple: AutoFocus V2
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 590,
          "y": -10
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "158":
    id: "158"
    taskid: b74e17f5-8ed6-4241-8b1b-ed2d0c65d2e6
    type: playbook
    task:
      id: b74e17f5-8ed6-4241-8b1b-ed2d0c65d2e6
      version: -1
      name: Autofocus - File Indicators Hunting
      playbookName: Autofocus - File Indicators Hunting
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "153"
    scriptarguments:
      MD5:
        complex:
          root: inputs.MD5
      SHA1:
        complex:
          root: inputs.SHA1
      SHA256:
        complex:
          root: inputs.SHA256
      Sample first seen:
        complex:
          root: inputs.Sample first seen
      Sample last modified:
        complex:
          root: inputs.Sample last modified
      SampleQuery:
        complex:
          root: inputs.SampleQuery
      Scope:
        complex:
          root: inputs.Scope
      Search Type:
        complex:
          root: inputs.Search Type
      SessionQuery:
        complex:
          root: inputs.SessionQuery
      Sessions time after:
        complex:
          root: inputs.Sessions time after
      Sessions time before:
        complex:
          root: inputs.Sessions time before
      Wildfire Verdict:
        complex:
          root: inputs.Wildfire Verdict
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 350,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "156_153_#default#": 0.32
    },
    "paper": {
      "dimensions": {
        "height": 535,
        "width": 860,
        "x": 350,
        "y": -140
      }
    }
  }
inputs:
- key: IPAddress
  value: {}
  required: false
  description: |-
    One or more IP addresses to search for in Autofocus simple mode search.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: URLDomain
  value: {}
  required: false
  description: |-
    One or more URLs and/or domains to search for in Autofocus simple mode search.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: MD5
  value: {}
  required: false
  description: |-
    One or more MD5 file hashes to search for in Autofocus simple mode search.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: SHA256
  value: {}
  required: false
  description: |-
    One or more SHA256 file hashes to search for in Autofocus simple mode search.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: SHA1
  value: {}
  required: false
  description: |-
    One or more SHA1 file hashes to search for in Autofocus simple mode search.

    Separate multiple search values by commas only (without spaces or any special characters).
  playbookInputQuery:
- key: Search Type
  value: {}
  required: true
  description: "Which Autofocus search types should be executed. \n\nPossible values are session, sample, tag, or all. Session and sample are the recommended search types for this playbook. \n\nSample-based search detects threat indicators or identifiers within samples sent to WildFire for analysis. \n\nSession-based search detects threat indicators or identifiers within various context details and session data provided by samples during sample submission. \n\nTag-based search identifies the most popular tags."
  playbookInputQuery:
- key: Scope
  value: {}
  required: true
  description: Search scope for sample and session. Possible values are industry, organization, global, or all.
  playbookInputQuery:
- key: SampleQuery
  value: {}
  required: false
  description: |-
    Use the Autofocus advanced search mode to leverage a variety of query options within a sample search. Advanced search requires you to specify all field names, parameters, and operators.

    The query currently supports only JSON format which can be extracted from the Autofocus web console API radio button.
  playbookInputQuery:
- key: Sample first seen
  value: {}
  required: false
  description: |-
    Narrow down a sample-based search by specifying the timestamp samples were first uploaded to WildFire for analysis (indicators will be searched within samples after this timestamp).

    Specify the time in ISO 8601 format, for example, 2019-09-12T00:00:00.
  playbookInputQuery:
- key: Sample last modified
  value: {}
  required: false
  description: |-
    Narrow down a sample-based search by specifying the timestamp samples were last modified (indicators will be searched within samples after this timestamp).

    Specify the time in ISO 8601 format, for example, 2019-09-12T00:00:00.
  playbookInputQuery:
- key: SessionQuery
  value: {}
  required: false
  description: |-
    Use the Autofocus advanced search mode to leverage a variety of query options within a session search. Advanced search requires you to specify all field names, parameters, and operators.

    The query currently supports only JSON format which can be extracted from the Autofocus web console API radio button.
  playbookInputQuery:
- key: Sessions time before
  value: {}
  required: false
  description: |-
    Narrow down a session-based search by specifying the query end timestamp (indicators will be searched within sessions before this timestamp).

    Specify the time in ISO 8601 format, for example, 2019-09-12T00:00:00.
  playbookInputQuery:
- key: Sessions time after
  value: {}
  required: false
  description: |-
    Narrow down a session-based search by specifying the query start timestamp (indicators will be searched within sessions after this timestamp).

    Specify the time in ISO 8601 format, for example, 2019-09-12T00:00:00.
  playbookInputQuery:
- key: Wildfire Verdict
  value: {}
  required: false
  description: "Filter results by WildFire classification assigned to samples based on properties, behaviors, and activities observed for files or email links during static and dynamic analysis.\n\nPossible values are malware, benign, phishing, and greyware. "
  playbookInputQuery:
outputs:
- contextPath: Autofocus.Samples.HuntingResults
  description: Sample objects containing relevant fields.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.Created
  description: The date the file was created.
  type: date
- contextPath: Autofocus.Samples.HuntingResults.Finished
  description: The date the file was finished.
  type: date
- contextPath: Autofocus.Samples.HuntingResults.FileName
  description: The name of the file.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.FileType
  description: The file type.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.SHA1
  description: The SHA1 hash of the file.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.SHA256
  description: The SHA256 hash of the file.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.MD5
  description: The MD5 hash of the file.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.Region
  description: The region of the sample.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.Tags
  description: The tags attached to the sample.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.TagGroups
  description: The groups of relevant tags.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.Verdict
  description: The verdict of the sample.
  type: number
- contextPath: Autofocus.Samples.HuntingResults.Artifact.confidence
  description: The decision confidence.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.Artifact.indicator
  description: The indicator that was tested.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.Artifact.indicator_type
  description: 'The indicator type, for example: Mutex, User agent, IPv4, Domain.'
  type: string
- contextPath: Autofocus.Samples.HuntingResults.Artifact.b
  description: How many set the artifact as benign.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.Artifact.g
  description: How many set the artifact as grayware.
  type: string
- contextPath: Autofocus.Samples.HuntingResults.Artifact.m
  description: How many set the artifact as malicious.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults
  description: Session objects containing relevant fields.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.Seen
  description: The seen date.
  type: date
- contextPath: Autofocus.Sessions.HuntingResults.UploadSource
  description: The source of the uploaded sample.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.ID
  description: The ID of the session. Used to get session details.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.FileName
  description: The name of the file.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.FileURL
  description: The URL of the file.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.SHA256
  description: The SHA256 hash of the file.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.Industry
  description: The related industry.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.Region
  description: The regions of the sessions.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.Tags
  description: The relevant tags.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.app
  description: The associated application name.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.dst_ip
  description: The associated destination IP.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.src_ip
  description: The associated source IP.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.dst_countrycode
  description: The associated destination country code.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.src_countrycode
  description: The associated source country code.
  type: string
- contextPath: Autofocus.Sessions.HuntingResults.dst_port
  description: The associated destination port number.
  type: number
- contextPath: Autofocus.Sessions.HuntingResults.src_port
  description: The associated source port number.
  type: number
- contextPath: Autofocus.Sessions.HuntingResults.user_id
  description: The recipient user ID.
  type: string
tests:
- No tests (auto formatted)
fromversion: 6.5.0
supportedModules:
- agentix
- xsiam