Autofocus Query Samples, Sessions and Tags Deprecated

Inputs

• Scope — Scope can be Private Public Global
• SampleQuery — Query needs to be provided in order to determine what to search for. Query is currently only in JSON format which can be extracted from the Autofocus web console API radio button. Query example for searching hashes can be {"operator":"any","children":[{"field":"sample.sha256","operator":"is","value":"4f79697b40d0932e91105bd496908f8e02c130a0e36f6d3434d6243e79ef82e0"},{"field":"sample.sha256","operator":"is","value":"7e93723c0c34ef98444e5ce9013fef220975b96291a79053fd4c9b3d3550aeb3"}]} Another example for searching for an IP {"operator":"any","children":[{"field":"sample.src_ip","operator":"is","value":"1.1.1.1"},{"field":"sample.dst_ip","operator":"is","value":"1.1.1.1"},{"field":"sample.src_ip","operator":"is","value":"2.2.2.2"},{"field":"sample.dst_ip","operator":"is","value":"2.2.2.2"}]}
• SessionQuery — Query needs to be provided in order to determine what to search for. Query is currently only in JSON format which can be extracted from the Autofocus web console API radio button. Query example for searching hashes can be {"operator":"any","children":[{"field":"session.sha256","operator":"is","value":"4f79697b40d0932e91105bd496908f8e02c130a0e36f6d3434d6243e79ef82e0"},{"field":"session.sha256","operator":"is","value":"7e93723c0c34ef98444e5ce9013fef220975b96291a79053fd4c9b3d3550aeb3"}]} Another example for searching for an IP {"operator":"any","children":[{"field":"session.src_ip","operator":"is","value":"1.1.1.1"},{"field":"session.dst_ip","operator":"is","value":"1.1.1.1"},{"field":"session.src_ip","operator":"is","value":"2.2.2.2"},{"field":"session.dst_ip","operator":"is","value":"2.2.2.2"}]}
• IP — IP to query
• Hash — Hash to query
• URL — URL to query
• Domain — Domain to query
• Search Type — Values can be session, sample, tag,all
• Wildfire Verdict — Values can be Malware,Benign,Phishing,Greyware
• Sessions time before — Timestamp in the following format 2019-09-12T00:00:00 This parameter checks for sessions prior to this timestamp
• Sessions time after — Timestamp in the following format 2019-09-12T00:00:00 This parameter checks for sessions after this timestamp
• Sample first seen — Timestamp in the following format 2019-09-12T00:00:00 This parameter checks for when the sample was first seen after this date.
• Sample last modified — Timestamp in the following format 2019-09-12T00:00:00 This parameter checks for when the sample was last modified after this date.
• Tags scope — Values can be industry, organization, all, global.
• Tags class — Values can be Actor, Campaign, Exploit, Malicious Behavior, Malware Family
• Tags private — Values can be True, False. If true the search will only focus on private (non public) objects. Default is false
• Tags public — Values can be True, False. If true the search will only focus on public (non private) objects. Default is false.
• Commodity — Values can be True, False. Default is false.
• Unit 42 — Values can be True, False. Default is false objects that have been analyzed by Palo Alto's Unit 42 global threat intelligence team.

Outputs

• AutoFocus.SessionsResults — Results of Autofocus sessions search.
• AutoFocus.SamplesResults — Results of Autofocus samples search.
• AutoFocus.TopTagResults — Results of Autofocus tags search.

Commands used