category: Data Enrichment & Threat Intelligence provider: Palo Alto Networks sectionorder: - Connect - Collect commonfields: id: AutoFocus V2 version: -1 configuration: - name: credentials type: 9 displaypassword: API Key hiddenusername: true required: false section: Connect - additionalinfo: TIM customers that upgraded to version 6.2 or above, can have this value pre-configured in their main account so no additional input is needed. To use this feature, upgrade your license so it includes the license key. display: API Key name: api_key type: 4 hidden: true required: false section: Connect - display: Source Reliability name: integrationReliability required: false type: 15 additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: B - Usually reliable options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged section: Collect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Collect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect - display: Suppress errors for non found indicators name: handle_error type: 8 defaultvalue: 'true' required: false section: Collect - display: Additional malicious verdicts name: mark_as_malicious type: 0 required: false section: Collect - additionalinfo: Create relationships between indicators as part of Enrichment. defaultvalue: 'true' display: Create relationships name: create_relationships type: 8 required: false section: Collect deprecated: true description: Deprecated. Use the Unit 42 Intelligence integration instead. display: Palo Alto Networks AutoFocus v2 (Deprecated) name: AutoFocus V2 script: commands: - arguments: - auto: PREDEFINED description: Use XSOAR built-in polling to retrieve the result when it's ready. name: polling predefined: - 'true' - 'false' - description: The query for which to retrieve samples. For additional information on how to build your query using the AF GUI, see the detailed description section. name: query - description: Interval in seconds between each poll. name: interval_in_seconds defaultValue: '60' - defaultValue: '30' description: The number of results to return. name: max_results - auto: PREDEFINED description: The field by which to sort the results. name: sort predefined: - App Name - App Packagename - File type - Size - Finish Date - First Seen (Create Date) - Last Updated (Update Date) - MD5 - SHA1 - SHA256 - Ssdeep Fuzzy Hash - auto: PREDEFINED description: The order of the results. Can be "Ascending" or "Descending". name: order predefined: - Ascending - Descending - auto: PREDEFINED description: ' The scope of the search. Can be "Private", "Public", or "Global".' name: scope predefined: - Private - Public - Global required: true - description: The MD5, SHA1 or SHA256 hash of the file. name: file_hash - description: The domain to search. name: domain - description: The IP address to search. name: ip - description: The URL to search. name: url - auto: PREDEFINED description: The Wildfire verdict. Can be "Malware", "Grayware", "Benign", or "Phishing". name: wildfire_verdict predefined: - Malware - Grayware - Benign - Phishing - description: 'The date range of the creation date. Format: YYY Y-MM-DDTHH:MM:SS,YYYY-MM-DDTHH:MM:SS where the first date is the beginning and the second is the end. Example: 2019-09-09T00:00:00,2019-09-09T23:01:59.' name: first_seen - description: 'The date range of the last updated date. Format: YYY Y-MM-DDTHH:MM:SS,YYYY-MM-DDTHH:MM:SS where the first date is the beginning and the second is the end. Example: 2019-09-09T00:00:00,2019-09-09T23:01:59.' name: last_updated - auto: PREDEFINED defaultValue: 'true' description: 'Whether to return artifacts of samples.' name: artifact predefined: - 'true' - 'false' - description: The AF Cookie for retrieving results of previous searches. The AF Cookie expires 120 seconds after the search completes. name: af_cookie - defaultValue: 'false' description: Whether an auto retry of the command will be executed once the quota is refreshed if the API points have run out. name: retry_on_rate_limit auto: PREDEFINED predefined: - 'true' - 'false' description: Searches for samples in AutoFocus. To view results, run the autofocus-samples-search-results command with the returned AF Cookie. The AF Cookie expires 120 seconds after the search completes. `Autofocus Query Samples, Sessions and Tags` Playbook is recommended for querying and polling. name: autofocus-search-samples polling: true outputs: - contextPath: AutoFocus.SamplesSearch.AFCookie description: The AutoFocus search ID. Use this ID to retrieve search results. The AF Cookie expires 120 seconds after the search completes. type: String - contextPath: AutoFocus.SamplesSearch.Status description: The search status. Can be "in progress" or "complete". type: String - contextPath: AutoFocus.SamplesSearch.SessionStart description: The time when the session began. type: Date - contextPath: AutoFocus.SamplesResults.Size description: The file size in bytes. type: String - contextPath: AutoFocus.SamplesResults.SHA1 description: The SHA1 hash of the file. type: String - contextPath: AutoFocus.SamplesResults.SHA256 description: The SHA256 hash of the file. type: String - contextPath: AutoFocus.SamplesResults.Created description: The date that the file was created. type: Date - contextPath: AutoFocus.SamplesResults.Finished description: Date finished. type: Date - contextPath: AutoFocus.SamplesResults.Region description: Region of the sample. type: String - contextPath: AutoFocus.SamplesResults.FileType description: The file type. type: String - contextPath: AutoFocus.SamplesResults.Tags description: The tags attached to the sample. type: String - contextPath: AutoFocus.SamplesResults.Verdict description: The verdict of the sample. type: Number - contextPath: AutoFocus.SamplesResults.TagGroups description: Groups of relevant tags. type: String - contextPath: AutoFocus.SamplesSearch.Status description: The search status. Can be "in progress" or "complete". type: String - contextPath: File.Size description: The size of the file in bytes. type: Number - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.Type description: The file type, as determined by libmagic (same as displayed in file entries). type: String - contextPath: File.Tags description: Tags of the file. type: String - contextPath: AutoFocus.SamplesResults.Artifact.b description: How many set the artifact as benign. type: Number - contextPath: AutoFocus.SamplesResults.Artifact.g description: How many set the artifact as grayware. type: Number - contextPath: AutoFocus.SamplesResults.Artifact.m description: How many set the artifact as malicious. type: Number - contextPath: AutoFocus.SamplesResults.Artifact.confidence description: Confidence in the decision. type: String - contextPath: AutoFocus.SamplesResults.Artifact.indicator description: The indicator that was tested. type: String - contextPath: AutoFocus.SamplesResults.Artifact.indicator_type description: 'The indicator type, for example: Mutex, User agent, IPv4, Domain.' type: String - contextPath: AutoFocus.SamplesResults.ID description: ID of sample search. type: String - contextPath: AutoFocus.Quota.minute_points description: Total number of AutoFocus API points alloted per minute. type: Number - contextPath: AutoFocus.Quota.daily_points description: Total number of AutoFocus API points alloted per day. type: Number - contextPath: AutoFocus.Quota.minute_points_remaining description: Remaining number of AutoFocus API points per minute. type: Number - contextPath: AutoFocus.Quota.daily_points_remaining description: Remaining number of AutoFocus API points per day. type: Number - contextPath: AutoFocus.Quota.minute_bucket_start description: Timestamp for when the current minute allotment started. type: Date - contextPath: AutoFocus.Quota.daily_bucket_start description: Timestamp for when the current daily allotment started. type: Date - arguments: - auto: PREDEFINED description: Use XSOAR built-in polling to retrieve the result when it's ready. name: polling predefined: - 'true' - 'false' - description: Interval in seconds between each poll. name: interval_in_seconds defaultValue: '60' - description: The AF Cookie for retrieving the results of a previous search. The AF Cookie expires 120 seconds after the search completes. name: af_cookie - description: The query for which to retrieve samples. For additional information on how to build your query using the AF GUI, see the detailed description section. name: query - defaultValue: '30' description: The maximum number of results to return. Default is 30. name: max_results - auto: PREDEFINED description: The field by which to sort the results. name: sort predefined: - Application - Device Country - Device Country Code - Device Hostname - Device Serial - Device vsys - Destination Country - Destination Country Code - Destination IP - Destination Port - Email Charset - Industry - Source Country - Source Country Code - Source IP - Source Port - SHA256 - Time - Upload source - auto: PREDEFINED description: The order of the results. Can be "Ascending" or "Descending". name: order predefined: - Ascending - Descending - description: The MD5, SHA1 or SHA256 hash of the file. name: file_hash - description: The domain to search. name: domain - description: The IP address to search. name: ip - description: The URL to search. name: url - description: 'The date range in which to search for sessions. Format: YYYY-MM-DDTHH:MM:SS,YYYY-MM-DDTHH:MM:SS where the first date is the beginning and the second is the end. Example: 2019-09-09T00:00:00,2019-09-09T23:01:59.' name: time_range predefined: - '' - description: 'The date after which to search for sessions. Format: YYYY-MM-DDTHH:MM:SS Example: 2019-09-09T23:01:59.' name: time_after - description: 'The date before which to search for sessions. Format: YYYY-MM-DDTHH:MM:SS Example: 2019-09-09T23:01:59.' name: time_before - defaultValue: 'false' description: Whether an auto retry of the command will be executed once the quota is refreshed if the API points have run out. name: retry_on_rate_limit auto: PREDEFINED predefined: - 'true' - 'false' description: Searches for sessions in AutoFocus. To view results, run the autofocus-sessions-search-results command with the returned AF Cookie. The AF Cookie expires 120 seconds after the search completes. The `polling` argument was added in XSOAR 6.2.0. It enables handling the search in a single command, rather than using the `Autofocus Query Samples, Sessions and Tags` Playbook. polling: true name: autofocus-search-sessions outputs: - contextPath: AutoFocus.SessionsSearch.AFCookie description: The AutoFocus search ID. Use this ID to get search results. The AF Cookie expires 120 seconds after the search completes. type: String - contextPath: AutoFocus.SessionsSearch.Status description: The search status. Can be "in progress" or "complete". type: String - contextPath: AutoFocus.SessionsSearch.SessionStart description: The time when the session began. type: Date - contextPath: AutoFocus.SessionsResults.FileName description: The name of the file.. type: String - contextPath: AutoFocus.SessionsResults.ID description: The session ID. Used to get session details. type: String - contextPath: AutoFocus.SessionsResults.Industry description: The related industry. type: String - contextPath: AutoFocus.SessionsResults.Region description: The regions of the sessions. type: String - contextPath: AutoFocus.SessionsResults.SHA256 description: The SHA256 hash of the file. type: String - contextPath: AutoFocus.SessionsResults.UploadSource description: The source of the uploaded sample. type: String - contextPath: AutoFocus.SessionsResults.FileURL description: The URL of the file. type: String - contextPath: AutoFocus.SessionsResults.Tags description: Relevant tags. type: String - contextPath: AutoFocus.SessionsSearch.Status description: The search status. Can be "in progress" or "complete". type: String - contextPath: File.Name description: The full file name (including file extension). type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.MalwareFamily description: The malware family associated with the file. type: String - contextPath: File.Tags description: Tags of the file. type: String - contextPath: AutoFocus.SessionsResults.Seen description: Session seen. type: Date - contextPath: AutoFocus.Quota.minute_points description: Total number of AutoFocus API points alloted per minute. type: Number - contextPath: AutoFocus.Quota.daily_points description: Total number of AutoFocus API points alloted per day. type: Number - contextPath: AutoFocus.Quota.minute_points_remaining description: Remaining number of AutoFocus API points per minute. type: Number - contextPath: AutoFocus.Quota.daily_points_remaining description: Remaining number of AutoFocus API points per day. type: Number - contextPath: AutoFocus.Quota.minute_bucket_start description: Timestamp for when the current minute allotment started. type: Date - contextPath: AutoFocus.Quota.daily_bucket_start description: Timestamp for when the current daily allotment started. type: Date - arguments: - description: The AF Cookie for retrieving results of previous searches. The AF Cookie expires 120 seconds after the search completes. name: af_cookie required: true - defaultValue: 'false' description: Whether an auto retry of the command will be executed once the quota is refreshed if the API points have run out. name: retry_on_rate_limit auto: PREDEFINED predefined: - 'true' - 'false' description: Returns results of a previous samples search. `Autofocus Query Samples, Sessions and Tags` Playbook is recommended for querying and polling. name: autofocus-samples-search-results outputs: - contextPath: AutoFocus.SamplesResults.Size description: The file size in bytes. type: String - contextPath: AutoFocus.SamplesResults.SHA1 description: The SHA1 hash of the file. type: String - contextPath: AutoFocus.SamplesResults.SHA256 description: The SHA256 hash of the file. type: String - contextPath: AutoFocus.SamplesResults.Created description: The date that the file was created. type: Date - contextPath: AutoFocus.SamplesResults.Finished description: Date finished. type: Date - contextPath: AutoFocus.SamplesResults.Region description: Region of the sample. type: String - contextPath: AutoFocus.SamplesResults.FileType description: The file type. type: String - contextPath: AutoFocus.SamplesResults.Tags description: The tags attached to the sample. type: String - contextPath: AutoFocus.SamplesResults.Verdict description: The verdict of the sample. type: Number - contextPath: AutoFocus.SamplesResults.TagGroups description: Groups of relevant tags. type: String - contextPath: AutoFocus.SamplesSearch.Status description: The search status. Can be "in progress" or "complete". type: String - contextPath: File.Size description: The size of the file in bytes. type: Number - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.Type description: The file type, as determined by libmagic (same as displayed in file entries). type: String - contextPath: File.Tags description: Tags of the file. type: String - contextPath: AutoFocus.SamplesResults.Artifact.b description: How many set the artifact as benign. type: Number - contextPath: AutoFocus.SamplesResults.Artifact.g description: How many set the artifact as grayware. type: Number - contextPath: AutoFocus.SamplesResults.Artifact.m description: How many set the artifact as malicious. type: Number - contextPath: AutoFocus.SamplesResults.Artifact.confidence description: Confidence in the decision. type: String - contextPath: AutoFocus.SamplesResults.Artifact.indicator description: The indicator that was tested. type: String - contextPath: AutoFocus.SamplesResults.Artifact.indicator_type description: 'The indicator type, for example: Mutex, User agent, IPv4, Domain.' type: String - contextPath: AutoFocus.SamplesResults.ID description: ID of sample search. type: String - contextPath: AutoFocus.Quota.minute_points description: Total number of AutoFocus API points alloted per minute. type: Number - contextPath: AutoFocus.Quota.daily_points description: Total number of AutoFocus API points alloted per day. type: Number - contextPath: AutoFocus.Quota.minute_points_remaining description: Remaining number of AutoFocus API points per minute. type: Number - contextPath: AutoFocus.Quota.daily_points_remaining description: Remaining number of AutoFocus API points per day. type: Number - contextPath: AutoFocus.Quota.minute_bucket_start description: Timestamp for when the current minute allotment started. type: Date - contextPath: AutoFocus.Quota.daily_bucket_start description: Timestamp for when the current daily allotment started. type: Date polling: true - arguments: - description: The AF Cookie for retrieving the results of a previous search. The AF Cookie expires 120 seconds after the search completes. name: af_cookie required: true - defaultValue: 'false' description: Whether an auto retry of the command will be executed once the quota is refreshed if the API points have run out. name: retry_on_rate_limit auto: PREDEFINED predefined: - 'true' - 'false' description: Returns results of a previous sessions search. `Autofocus Query Samples, Sessions and Tags` Playbook is recommended for querying and polling. name: autofocus-sessions-search-results outputs: - contextPath: AutoFocus.SessionsResults.FileName description: The name of the file.. type: String - contextPath: AutoFocus.SessionsResults.ID description: The session ID. Used to get session details. type: String - contextPath: AutoFocus.SessionsResults.Industry description: The related industry. type: String - contextPath: AutoFocus.SessionsResults.Region description: The regions of the sessions. type: String - contextPath: AutoFocus.SessionsResults.SHA256 description: The SHA256 hash of the file. type: String - contextPath: AutoFocus.SessionsResults.UploadSource description: The source of the uploaded sample. type: String - contextPath: AutoFocus.SessionsResults.FileURL description: The URL of the file. type: String - contextPath: AutoFocus.SessionsResults.Tags description: Relevant tags. type: String - contextPath: AutoFocus.SessionsSearch.Status description: The search status. Can be "in progress" or "complete". type: String - contextPath: File.Name description: The full file name (including file extension). type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.MalwareFamily description: The malware family associated with the file. type: String - contextPath: File.Tags description: Tags of the file. type: String - contextPath: AutoFocus.SessionsResults.Seen description: Session seen. type: Date - contextPath: AutoFocus.Quota.minute_points description: Total number of AutoFocus API points alloted per minute. type: Number - contextPath: AutoFocus.Quota.daily_points description: Total number of AutoFocus API points alloted per day. type: Number - contextPath: AutoFocus.Quota.minute_points_remaining description: Remaining number of AutoFocus API points per minute. type: Number - contextPath: AutoFocus.Quota.daily_points_remaining description: Remaining number of AutoFocus API points per day. type: Number - contextPath: AutoFocus.Quota.minute_bucket_start description: Timestamp for when the current minute allotment started. type: Date - contextPath: AutoFocus.Quota.daily_bucket_start description: Timestamp for when the current daily allotment started. type: Date polling: true - arguments: - description: The session ID. name: session_id required: true - defaultValue: 'false' description: Whether an auto retry of the command will be executed once the quota is refreshed if the API points have run out. name: retry_on_rate_limit auto: PREDEFINED predefined: - 'true' - 'false' description: Get session details by session ID. name: autofocus-get-session-details outputs: - contextPath: AutoFocus.Sessions.FileName description: The file name. type: String - contextPath: AutoFocus.Sessions.ID description: The session ID. type: String - contextPath: AutoFocus.Sessions.Industry description: The related industry. type: String - contextPath: AutoFocus.Sessions.Region description: Session regions. type: String - contextPath: AutoFocus.Sessions.SHA256 description: TheSHA256 hash of the file. type: String - contextPath: AutoFocus.Sessions.Seen description: Seen date. type: Date - contextPath: AutoFocus.Sessions.UploadSource description: The source that uploaded the sample. type: String - contextPath: File.Name description: The full file name (including file extension). type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: AutoFocus.Quota.minute_points description: Total number of AutoFocus API points alloted per minute. type: Number - contextPath: AutoFocus.Quota.daily_points description: Total number of AutoFocus API points alloted per day. type: Number - contextPath: AutoFocus.Quota.minute_points_remaining description: Remaining number of AutoFocus API points per minute. type: Number - contextPath: AutoFocus.Quota.daily_points_remaining description: Remaining number of AutoFocus API points per day. type: Number - contextPath: AutoFocus.Quota.minute_bucket_start description: Timestamp for when the current minute allotment started. type: Date - contextPath: AutoFocus.Quota.daily_bucket_start description: Timestamp for when the current daily allotment started. type: Date polling: true - arguments: - description: The SHA256 hash of the sample to analyze. name: sample_id required: true - auto: PREDEFINED description: The analysis environment. Can be "win7", "winxp", "android", "static_analyzer", "mac", or "bare_metal". name: os predefined: - win7 - winxp - android - static_analyzer - mac - bare_metal - auto: PREDEFINED defaultValue: 'True' description: Whether to smartly filter the data. If "False", the data returned will not be smartly filtered, and will significantly reduce integration performance. We recommend setting this to "True". name: filter_data predefined: - 'True' - 'False' - defaultValue: 'false' description: Whether an auto retry of the command will be executed once the quota is refreshed if the API points have run out. name: retry_on_rate_limit auto: PREDEFINED predefined: - 'true' - 'false' description: Returns properties, behaviors, and activities observed for a sample. Run the command a single time to get the fields and operating systems under HTTP, Coverage, Behavior, Registry, Files, Processes, Connections, and DNS. name: autofocus-sample-analysis outputs: - contextPath: AutoFocus.SampleAnalysis.Analysis.Http description: HTTP requests made when the sample was executed. type: Unknown - contextPath: AutoFocus.SampleAnalysis.Analysis.Coverage description: WildFire signatures that matched to the sample. type: Unknown - contextPath: AutoFocus.SampleAnalysis.Analysis.Behavior description: 'Sample behavior: created or modified files, started a process, spawned new processes, modified the registry, or installed browser help objects.' type: Unknown - contextPath: AutoFocus.SampleAnalysis.Analysis.Registry description: Registry settings and options that showed activity when the sample was executed in the analysis environment. type: Unknown - contextPath: AutoFocus.SampleAnalysis.Analysis.Files description: Files that showed activity as a result of the sample being executed. type: Unknown - contextPath: AutoFocus.SampleAnalysis.Analysis.Processes description: Processes that showed activity when the sample was executed. type: Unknown - contextPath: AutoFocus.SampleAnalysis.Analysis.Connections description: Connections to other hosts on the network when the sample was executed. type: Unknown - contextPath: AutoFocus.SampleAnalysis.Analysis.Dns description: DNS activity observed when the sample was executed. type: Unknown - contextPath: AutoFocus.SampleAnalysis.Analysis.Mutex description: The mutex created when the programs start is listed with the parent process if the sample generates other program threads when executed in the analysis environment. type: Unknown - contextPath: AutoFocus.Quota.minute_points description: Total number of AutoFocus API points alloted per minute. type: Number - contextPath: AutoFocus.Quota.daily_points description: Total number of AutoFocus API points alloted per day. type: Number - contextPath: AutoFocus.Quota.minute_points_remaining description: Remaining number of AutoFocus API points per minute. type: Number - contextPath: AutoFocus.Quota.daily_points_remaining description: Remaining number of AutoFocus API points per day. type: Number - contextPath: AutoFocus.Quota.minute_bucket_start description: Timestamp for when the current minute allotment started. type: Date - contextPath: AutoFocus.Quota.daily_bucket_start description: Timestamp for when the current daily allotment started. type: Date polling: true - arguments: - description: The public tag name. Can be retrieved from the top-tags command. name: tag_name required: true - defaultValue: 'false' description: Whether an auto retry of the command will be executed once the quota is refreshed if the API points have run out. name: retry_on_rate_limit auto: PREDEFINED predefined: - 'true' - 'false' description: Returns details about the given tag. name: autofocus-tag-details outputs: - contextPath: AutoFocus.Tag.TagName description: The simple name of the tag. type: String - contextPath: AutoFocus.Tag.PublicTagName description: The public name of the tag. This is used as an ID of the tag. type: String - contextPath: AutoFocus.Tag.Count description: The number of samples that matched this tag. type: Number - contextPath: AutoFocus.Tag.Lasthit description: The date that the tag was last encountered. type: Date - contextPath: AutoFocus.Tag.TagDefinitionScope description: The scope of the tag ("public", "private", or "Unit42"). type: String - contextPath: AutoFocus.Tag.CustomerName description: The organization that created the tag. type: String - contextPath: AutoFocus.Tag.Source description: The organization or individual that discovered the threat that is defined in the tag. type: String - contextPath: AutoFocus.Tag.TagClass description: The classification of the tag. type: String - contextPath: AutoFocus.Tag.TagDefinitionStatus description: The status of the tag definition ("enabled", "disabled", "removing", or "rescoping"). type: String - contextPath: AutoFocus.Tag.TagGroup description: The tag group of the tag. type: String - contextPath: AutoFocus.Tag.Description description: Tag description. type: String - contextPath: AutoFocus.Quota.minute_points description: Total number of AutoFocus API points alloted per minute. type: Number - contextPath: AutoFocus.Quota.daily_points description: Total number of AutoFocus API points alloted per day. type: Number - contextPath: AutoFocus.Quota.minute_points_remaining description: Remaining number of AutoFocus API points per minute. type: Number - contextPath: AutoFocus.Quota.daily_points_remaining description: Remaining number of AutoFocus API points per day. type: Number - contextPath: AutoFocus.Quota.minute_bucket_start description: Timestamp for when the current minute allotment started. type: Date - contextPath: AutoFocus.Quota.daily_bucket_start description: Timestamp for when the current daily allotment started. type: Date polling: true - arguments: - auto: PREDEFINED description: Scope of the search. Can be "industry", "organization", "all", or "global". name: scope predefined: - industry - organization - all - global required: true - auto: PREDEFINED description: Use XSOAR built-in polling to retrieve the result when it's ready. name: polling predefined: - 'true' - 'false' - description: The AF Cookie for retrieving results of previous searches. The AF Cookie expires 120 seconds after the search completes. name: af_cookie - description: Interval in seconds between each poll. name: interval_in_seconds defaultValue: '40' - auto: PREDEFINED description: 'Tag class. - Malware Family: group of malware that have shared properties or common functions. - Campaign: targeted attack, which might include several incidents or sets of activities. - Actor: individual or group that initiates a campaign using malware families. - Exploit: an attack, which takes advantage of a software or network weakness, bug, or vulnerability to manipulate the behavior of the system. - Malicious Behavior: behavior that is not specific to a malware family or campaign, but indicates that your system has been compromised.' name: class predefined: - Actor - Campaign - Exploit - Malicious Behavior - Malware Family required: true - auto: PREDEFINED defaultValue: 'False' description: Whether the tag scope is "private". If "True", the tag scope is private. Default is "False". name: private predefined: - 'True' - 'False' - auto: PREDEFINED defaultValue: 'False' description: Whether the tag scope is "public". If "True", the tag scope is public. Default is "False". name: public predefined: - 'True' - 'False' - auto: PREDEFINED defaultValue: 'False' description: Whether the tag scope is "commodity". If "True", the tag scope is commodity. Default is "False". name: commodity predefined: - 'True' - 'False' - auto: PREDEFINED defaultValue: 'False' description: Whether the tag scope is "Unit42". If "True", the tag scope is unit42. Default is "False". name: unit42 predefined: - 'True' - 'False' - defaultValue: 'false' description: Whether an auto retry of the command will be executed once the quota is refreshed if the API points have run out. name: retry_on_rate_limit auto: PREDEFINED predefined: - 'true' - 'false' description: Performs a search to identify the most popular tags. `Autofocus Query Samples, Sessions and Tags` Playbook is recommended for querying and polling. name: autofocus-top-tags-search polling: true outputs: - contextPath: AutoFocus.TopTagsSearch.AFCookie description: AutoFocus search ID. Use this ID to get search results. The AF Cookie expires 120 seconds after the search completes. type: String - contextPath: AutoFocus.TopTagsSearch.Status description: The search status. Can be "in progress" or "complete". type: String - contextPath: AutoFocus.SamplesSearch.SessionStart description: The time when the session began. type: Date - contextPath: AutoFocus.TopTagsResults.Count description: The number of samples that matched this tag. type: Number - contextPath: AutoFocus.TopTagsResults.PublicTagName description: The public name of the tag. This is used as an ID of the tag. type: String - contextPath: AutoFocus.TopTagsResults.TagName description: The simple name of the tag. type: String - contextPath: AutoFocus.TopTagsResults.Lasthit description: The last encounter date of the tag. type: Date - contextPath: AutoFocus.TopTagsSearch.Status description: The search status. Can be "in progress" or "complete". type: String - contextPath: AutoFocus.Quota.minute_points description: Total number of AutoFocus API points alloted per minute. type: Number - contextPath: AutoFocus.Quota.daily_points description: Total number of AutoFocus API points alloted per day. type: Number - contextPath: AutoFocus.Quota.minute_points_remaining description: Remaining number of AutoFocus API points per minute. type: Number - contextPath: AutoFocus.Quota.daily_points_remaining description: Remaining number of AutoFocus API points per day. type: Number - contextPath: AutoFocus.Quota.minute_bucket_start description: Timestamp for when the current minute allotment started. type: Date - contextPath: AutoFocus.Quota.daily_bucket_start description: Timestamp for when the current daily allotment started. type: Date - arguments: - description: 'The AF Cookie for retrieving results of previous search. Note: The AF Cookie expires 120 seconds after the search completes.' name: af_cookie required: true - defaultValue: 'false' description: Whether an auto retry of the command will be executed once the quota is refreshed if the API points have run out. name: retry_on_rate_limit auto: PREDEFINED predefined: - 'true' - 'false' description: Returns the results of a previous top tags search. `Autofocus Query Samples, Sessions and Tags` Playbook is recommended for querying and polling. name: autofocus-top-tags-results outputs: - contextPath: AutoFocus.TopTagsResults.Count description: The number of samples that matched this tag. type: Number - contextPath: AutoFocus.TopTagsResults.PublicTagName description: The public name of the tag. This is used as an ID of the tag. type: String - contextPath: AutoFocus.TopTagsResults.TagName description: The simple name of the tag. type: String - contextPath: AutoFocus.TopTagsResults.Lasthit description: The last encounter date of the tag. type: Date - contextPath: AutoFocus.TopTagsSearch.Status description: The search status. Can be "in progress" or "complete". type: String - contextPath: AutoFocus.Quota.minute_points description: Total number of AutoFocus API points alloted per minute. type: Number - contextPath: AutoFocus.Quota.daily_points description: Total number of AutoFocus API points alloted per day. type: Number - contextPath: AutoFocus.Quota.minute_points_remaining description: Remaining number of AutoFocus API points per minute. type: Number - contextPath: AutoFocus.Quota.daily_points_remaining description: Remaining number of AutoFocus API points per day. type: Number - contextPath: AutoFocus.Quota.minute_bucket_start description: Timestamp for when the current minute allotment started. type: Date - contextPath: AutoFocus.Quota.daily_bucket_start description: Timestamp for when the current daily allotment started. type: Date polling: true - arguments: - default: true description: IP address to check. isArray: true name: ip required: true description: Checks the reputation of an IP address in AutoFocus. name: ip outputs: - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: IP.Address description: The IP address. type: String - contextPath: IP.Relationships.EntityA description: The source of the relationship. type: string - contextPath: IP.Relationships.EntityB description: The destination of the relationship. type: string - contextPath: IP.Relationships.Relationship description: The name of the relationship. type: string - contextPath: IP.Relationships.EntityAType description: The type of the source of the relationship. type: string - contextPath: IP.Relationships.EntityBType description: The type of the destination of the relationship. type: string - contextPath: AutoFocus.IP.IndicatorValue description: The IP address. type: String - contextPath: AutoFocus.IP.IndicatorType description: The indicator type. type: String - contextPath: AutoFocus.IP.LatestPanVerdicts description: Latest verdicts from Palo Alto Networks products. Can be either PAN_DB or WF_SAMPLE(WildFire). type: Unknown - contextPath: IP.Malicious.Vendor description: For malicious files, the vendor that made the decision. type: String - contextPath: IP.MalwareFamily description: The malware family associated with the IP. type: String - contextPath: IP.Tags description: Tags that are associated with the IP. type: String - contextPath: AutoFocus.IP.Tags.PublicTagName description: The public name of the tag. This is used as an ID of the tag. type: String - contextPath: AutoFocus.IP.Tags.TagName description: The simple name of the tag. type: String - contextPath: AutoFocus.IP.Tags.CustomerName description: The organization that created the tag. type: String - contextPath: AutoFocus.IP.Tags.Source description: The organization or individual that discovered the threat that is defined in the tag. type: String - contextPath: AutoFocus.IP.Tags.TagDefinitionScopeID description: The scope ID of the tag. type: Number - contextPath: AutoFocus.IP.Tags.TagDefinitionStatusID description: The definition status ID of the tag. type: Number - contextPath: AutoFocus.IP.Tags.TagClassID description: The classification ID of the tag. type: Number - contextPath: AutoFocus.IP.Tags.Count description: The number of samples that matched this tag. type: Number - contextPath: AutoFocus.IP.Tags.Lasthit description: The date that the tag was last encountered. type: Date - contextPath: AutoFocus.IP.Tags.Description description: The tag description. type: String - arguments: - default: true description: URL to check. isArray: true name: url required: true - description: A char to separate between the url's. isArray: true name: separator required: false defaultValue: ',' description: Checks the reputation of a URL in AutoFocus. name: url outputs: - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: URL.Data description: The URL address. type: String - contextPath: URL.Relationships.EntityA description: The source of the relationship. type: string - contextPath: URL.Relationships.EntityB description: The destination of the relationship. type: string - contextPath: URL.Relationships.Relationship description: The name of the relationship. type: string - contextPath: URL.Relationships.EntityAType description: The type of the source of the relationship. type: string - contextPath: URL.Relationships.EntityBType description: The type of the destination of the relationship. type: string - contextPath: AutoFocus.URL.IndicatorValue description: The URL value. type: String - contextPath: AutoFocus.URL.IndicatorType description: The indicator type. type: String - contextPath: AutoFocus.URL.LatestPanVerdicts description: Latest verdicts from Palo Alto Networks products. Can be either PAN_DB or WF_SAMPLE(WildFire). type: Unknown - contextPath: URL.Malicious.Vendor description: For malicious files, the vendor that made the decision. type: String - contextPath: URL.MalwareFamily description: The malware family associated with the url. type: String - contextPath: URL.Tags description: Tags that are associated with the url. type: String - contextPath: AutoFocus.URL.Tags.PublicTagName description: The public name of the tag. This is used as an ID of the tag. type: String - contextPath: AutoFocus.URL.Tags.TagName description: The simple name of the tag. type: String - contextPath: AutoFocus.URL.Tags.CustomerName description: The organization that created the tag. type: String - contextPath: AutoFocus.URL.Tags.Source description: The organization or individual that discovered the threat that is defined in the tag. type: String - contextPath: AutoFocus.URL.Tags.TagDefinitionScopeID description: The scope ID of the tag. type: Number - contextPath: AutoFocus.URL.Tags.TagDefinitionStatusID description: The definition status ID of the tag. type: Number - contextPath: AutoFocus.URL.Tags.TagClassID description: The classification ID of the tag. type: Number - contextPath: AutoFocus.URL.Tags.Count description: The number of samples that matched this tag. type: Number - contextPath: AutoFocus.URL.Tags.Lasthit description: The date that the tag was last encountered. type: Date - contextPath: AutoFocus.URL.Tags.Description description: The tag description. type: String - arguments: - default: true description: Hash of the file to query. Supports MD5, SHA1, and SHA256. isArray: true name: file required: true description: Checks the reputation of a file in AutoFocus. name: file outputs: - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: File.SHA256 description: SHA256 hash of the file. type: String - contextPath: File.Relationships.EntityA description: The source of the relationship. type: string - contextPath: File.Relationships.EntityB description: The destination of the relationship. type: string - contextPath: File.Relationships.Relationship description: The name of the relationship. type: string - contextPath: File.Relationships.EntityAType description: The type of the source of the relationship. type: string - contextPath: File.Relationships.EntityBType description: The type of the destination of the relationship. type: string - contextPath: File.Tags.TagGroups.TagGroupName description: The tag's group name. type: String - contextPath: File.Tags.Aliases description: Aliases of the tags. type: String - contextPath: File.Tags.PublicTagName description: The public name of the tag. This is usually used as the ID of the tag. type: String - contextPath: File.Tags.TagName description: The simple name of the tag. type: String - contextPath: AutoFocus.File.IndicatorValue description: SHA256 of the file. type: String - contextPath: AutoFocus.File.IndicatorType description: The indicator type. type: String - contextPath: AutoFocus.File.LatestPanVerdicts description: Latest verdicts from Palo Alto Networks products. Can be either PAN_DB or WF_SAMPLE(WildFire). type: Unknown - contextPath: File.Malicious.Vendor description: For malicious files, the vendor that made the decision. type: String - contextPath: AutoFocus.File.Tags.PublicTagName description: The public name of the tag. This is used as an ID of the tag. type: String - contextPath: AutoFocus.File.Tags.TagName description: The simple name of the tag. type: String - contextPath: AutoFocus.File.Tags.CustomerName description: The organization that created the tag. type: String - contextPath: AutoFocus.File.Tags.Source description: The organization or individual that discovered the threat that is defined in the tag. type: String - contextPath: AutoFocus.File.Tags.TagDefinitionScopeID description: The scope ID of the tag. type: Number - contextPath: AutoFocus.File.Tags.TagDefinitionStatusID description: The definition status ID of the tag. type: Number - contextPath: AutoFocus.File.Tags.TagClassID description: The classification ID of the tag. type: Number - contextPath: AutoFocus.File.Tags.Count description: The number of samples that matched this tag. type: Number - contextPath: AutoFocus.File.Tags.Lasthit description: The date that the tag was last encountered. type: Date - contextPath: AutoFocus.File.Tags.Description description: The tag description. type: String - arguments: - default: true description: The domain to check. isArray: true name: domain required: true description: Checks the reputation of a domain in AutoFocus. name: domain outputs: - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: AutoFocus.Domain.IndicatorValue description: The domain. type: String - contextPath: AutoFocus.Domain.IndicatorType description: The indicator type. type: String - contextPath: AutoFocus.Domain.LatestPanVerdicts description: Latest verdicts from Palo Alto Networks products. Can be either PAN_DB or WF_SAMPLE(WildFire). type: Unknown - contextPath: AutoFocus.Domain.Tags.PublicTagName description: The public name of the tag. This is used as an ID of the tag. type: String - contextPath: AutoFocus.Domain.Tags.TagName description: The simple name of the tag. type: String - contextPath: AutoFocus.Domain.Tags.CustomerName description: The organization that created the tag. type: String - contextPath: AutoFocus.Domain.Tags.Source description: The organization or individual that discovered the threat that is defined in the tag. type: String - contextPath: AutoFocus.Domain.Tags.TagDefinitionScopeID description: The scope ID of the tag. type: Number - contextPath: AutoFocus.Domain.Tags.TagDefinitionStatusID description: The definition status ID of the tag. type: Number - contextPath: AutoFocus.Domain.Tags.TagClassID description: The classification ID of the tag. type: Number - contextPath: AutoFocus.Domain.Tags.Count description: The number of samples that matched this tag. type: Number - contextPath: AutoFocus.Domain.Tags.Lasthit description: The date that the tag was last encountered. type: Date - contextPath: AutoFocus.Domain.Tags.Description description: The tag description. type: String - contextPath: AutoFocus.Domain.WhoisAdminCountry description: The country of the domain administrator. type: String - contextPath: AutoFocus.Domain.WhoisAdminEmail description: The email address of the domain administrator. type: String - contextPath: AutoFocus.Domain.WhoisAdminName description: The name of the domain administrator. type: String - contextPath: AutoFocus.Domain.WhoisDomainCreationDate description: The date that the domain was created. type: Date - contextPath: AutoFocus.Domain.WhoisDomainExpireDate description: The date that the domain expires. type: Date - contextPath: AutoFocus.Domain.WhoisDomainUpdateDate description: The date that the domain was last updated. type: Date - contextPath: AutoFocus.Domain.WhoisRegistrar description: The name of the registrar. type: String - contextPath: AutoFocus.Domain.WhoisRegistrarUrl description: The email address of the registrar. type: String - contextPath: AutoFocus.Domain.WhoisRegistrant description: The name of the registrant. type: String - contextPath: Domain.Name description: 'The domain name, for example: "google.com".' type: String - contextPath: Domain.Malicious.Vendor description: For malicious files, the vendor that made the decision. type: String - contextPath: Domain.MalwareFamily description: The malware family associated with the domain. type: String - contextPath: Domain.Relationships.EntityA description: The source of the relationship. type: string - contextPath: Domain.Relationships.EntityB description: The destination of the relationship. type: string - contextPath: Domain.Relationships.Relationship description: The name of the relationship. type: string - contextPath: Domain.Relationships.EntityAType description: The type of the source of the relationship. type: string - contextPath: Domain.Relationships.EntityBType description: The type of the destination of the relationship. type: string - contextPath: Domain.Tags description: Tags that are associated with the domain. type: String - contextPath: Domain.CreationDate description: The date that the domain was created. type: Date - contextPath: Domain.UpdatedDate description: The date that the domain was last updated. type: String - contextPath: Domain.ExpirationDate description: The expiration date of the domain. type: Date - contextPath: Domain.Admin.Country description: The country of the domain administrator. type: String - contextPath: Domain.Admin.Email description: The email address of the domain administrator. type: String - contextPath: Domain.Admin.Name description: The name of the domain administrator. type: String - contextPath: Domain.Registrant.Name description: The name of the registrant. type: String - contextPath: Domain.WHOIS.Registrar.Name description: 'The name of the registrar, for example: "GoDaddy".' type: String - arguments: - description: The label of the exported list. name: label required: true - defaultValue: 'false' description: Whether an auto retry of the command will be executed once the quota is refreshed if the API points have run out. name: retry_on_rate_limit auto: PREDEFINED predefined: - 'true' - 'false' description: Gets export list indicators from AutoFocus. name: autofocus-get-export-list-indicators outputs: - contextPath: AutoFocus.ExportListIndicator.Type description: 'The indicator type in the export list. ' type: String - contextPath: AutoFocus.ExportListIndicator.Value description: The value of the indicator in the export list. type: String - contextPath: IP.Address description: The IP address. type: String - contextPath: URL.Data description: The URL address. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: Domain.Name description: The domain name. type: String polling: true dockerimage: demisto/python3:3.12.8.3296088 runonce: false script: '-' subtype: python3 type: python tests: - AutoFocus V2 test fromversion: 5.0.0