id: Autofocus - File Indicators Hunting version: -1 contentitemexportablefields: contentitemfields: {} name: Autofocus - File Indicators Hunting deprecated: true description: "Deprecated. No available replacement. The playbook queries the PANW Autofocus session and samples log data for file indicators such as MD5, SHA256, and SHA1 hashes. \n\nA simple search mode is used to query Autofocus based on the file indicators specified in the playbook inputs. Advanced search mode queries can also be used with multiple query parameters, but require all field names, parameters, and operators (JSON format) to be specified. \nWe recommended using the Autofocus UI to create an advanced query, exporting it, and pasting it into the relevant playbook inputs. \n\nNote that multiple search values should be separated by commas only (without spaces or any special characters)." starttaskid: "0" tasks: "0": id: "0" taskid: efd174b1-c3ae-48ce-8d14-52e397954612 type: start task: id: efd174b1-c3ae-48ce-8d14-52e397954612 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "216" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1500, "y": 345 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "153": id: "153" taskid: 3ab00780-9973-4e65-8271-1f0d598b5fbd type: title task: id: 3ab00780-9973-4e65-8271-1f0d598b5fbd version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1500, "y": 1130 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "216": id: "216" taskid: 0370eaaa-158d-4e7b-892e-2d775ec0e9c3 type: condition task: id: 0370eaaa-158d-4e7b-892e-2d775ec0e9c3 version: -1 name: Any file hash to hunt for? description: Checks whether there are any file hashes available for searching. type: condition iscommand: false brand: "" nexttasks: '#default#': - "153" "yes": - "221" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.FileHash iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": 1500, "y": 480 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "221": id: "221" taskid: ea34de11-75f6-42c9-844e-2137532ea54a type: title task: id: ea34de11-75f6-42c9-844e-2137532ea54a version: -1 name: Search File Hashes type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "227" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1050, "y": 650 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "227": id: "227" taskid: 5eff5255-3ad4-4fe0-86dc-c2c7726b26b8 type: playbook task: id: 5eff5255-3ad4-4fe0-86dc-c2c7726b26b8 version: -1 name: Autofocus Query Samples, Sessions and Tags description: |- This playbook queries the PANW Threat Intelligence Autofocus system. The playbook accepts indicators such as IPs, hashes, and domains to run basic queries or advanced queries that can leverage several query parameters. To run the more advanced queries we recommended using the Autofocus UI https://autofocus.paloaltonetworks.com/#/dashboard/organization to create a query and then using the export search button. The result can be used as a playbook input. This playbook supports searching both the Samples API and the Sessions API. playbookName: Autofocus Query Samples, Sessions and Tags type: playbook iscommand: false brand: "" nexttasks: '#none#': - "233" - "234" scriptarguments: Commodity: complex: root: inputs.Commodity Hash: complex: root: inputs.FileHash transformers: - operator: toUpperCase - operator: split args: delimiter: value: simple: ',' - operator: uniq Sample first seen: complex: root: inputs.Sample first seen Sample last modified: complex: root: inputs.Sample last modified SampleQuery: complex: root: inputs filters: - - operator: isNotEmpty left: value: simple: inputs.SampleQuery iscontext: true accessor: SampleQuery Scope: complex: root: inputs.Scope filters: - - operator: containsGeneral left: value: simple: inputs.Scope iscontext: true right: value: simple: industry ignorecase: true - operator: containsGeneral left: value: simple: inputs.Scope iscontext: true right: value: simple: organization ignorecase: true - operator: containsGeneral left: value: simple: inputs.Scope iscontext: true right: value: simple: global ignorecase: true - operator: containsGeneral left: value: simple: inputs.Scope iscontext: true right: value: simple: all ignorecase: true Search Type: complex: root: inputs.Search Type filters: - - operator: containsGeneral left: value: simple: inputs.Search Type iscontext: true right: value: simple: session ignorecase: true - operator: containsGeneral left: value: simple: inputs.Search Type iscontext: true right: value: simple: sample ignorecase: true - operator: containsGeneral left: value: simple: inputs.Search Type iscontext: true right: value: simple: tag ignorecase: true - operator: containsGeneral left: value: simple: inputs.Search Type iscontext: true right: value: simple: all ignorecase: true SessionQuery: complex: root: inputs.SessionQuery filters: - - operator: isNotEmpty left: value: simple: inputs.SessionQuery iscontext: true Sessions time after: complex: root: inputs.Sessions time after Sessions time before: complex: root: inputs.Sessions time before Tags class: complex: root: inputs.Tags class filters: - - operator: containsGeneral left: value: simple: inputs.Tags class iscontext: true right: value: simple: Actor ignorecase: true - operator: containsGeneral left: value: simple: inputs.Tags class iscontext: true right: value: simple: Campaign ignorecase: true - operator: containsGeneral left: value: simple: inputs.Tags class iscontext: true right: value: simple: Exploit ignorecase: true - operator: containsGeneral left: value: simple: inputs.Tags class iscontext: true right: value: simple: Malicious Behavior ignorecase: true - operator: containsGeneral left: value: simple: inputs.Tags class iscontext: true right: value: simple: Malware Family ignorecase: true Tags private: complex: root: inputs.Tags private Tags public: complex: root: inputs.Tags public Tags scope: complex: root: inputs.Tags scope filters: - - operator: containsGeneral left: value: simple: inputs.Tags scope iscontext: true right: value: simple: industry ignorecase: true - operator: containsGeneral left: value: simple: inputs.Tags scope iscontext: true right: value: simple: organization ignorecase: true - operator: containsGeneral left: value: simple: inputs.Tags scope iscontext: true right: value: simple: global ignorecase: true - operator: containsGeneral left: value: simple: inputs.Tags scope iscontext: true right: value: simple: all ignorecase: true Unit 42: complex: root: inputs.Unit 42 Wildfire Verdict: complex: root: inputs.wildfire_verdict filters: - - operator: isNotEmpty left: value: simple: inputs.wildfire_verdict iscontext: true - - operator: containsGeneral left: value: simple: inputs.wildfire_verdict iscontext: true right: value: simple: Malware ignorecase: true - operator: containsGeneral left: value: simple: inputs.wildfire_verdict iscontext: true right: value: simple: Grayware ignorecase: true - operator: containsGeneral left: value: simple: inputs.wildfire_verdict iscontext: true right: value: simple: Benign ignorecase: true - operator: isEqualString left: value: simple: inputs.wildfire_verdict iscontext: true right: value: simple: Phishing ignorecase: true separatecontext: true continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1050, "y": 785 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "233": id: "233" taskid: ada25639-fff8-4779-84e2-f5cd2ecc0bd7 type: regular task: id: ada25639-fff8-4779-84e2-f5cd2ecc0bd7 version: -1 name: Save Matching Results - Sessions Search description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "153" scriptarguments: append: simple: "true" key: simple: Autofocus.Sessions.HuntingResults value: complex: root: AutoFocus.SessionsResults filters: - - operator: isNotEmpty left: value: simple: AutoFocus.SessionsResults.SHA256 iscontext: true - - operator: notInList left: value: simple: AutoFocus.SessionsResults.SHA256 iscontext: true right: value: simple: inputs.SHA256 iscontext: true ignorecase: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1270, "y": 955 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "234": id: "234" taskid: 399883e1-3bd8-492c-82dd-0c2548f1500a type: regular task: id: 399883e1-3bd8-492c-82dd-0c2548f1500a version: -1 name: Save Matching Results - Samples Results description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "153" scriptarguments: append: simple: "true" key: simple: Autofocus.Samples.HuntingResults value: complex: root: AutoFocus.SamplesResults filters: - - operator: isNotEmpty left: value: simple: AutoFocus.SamplesResults.MD5 iscontext: true - operator: isNotEmpty left: value: simple: AutoFocus.SamplesResults.SHA1 iscontext: true - operator: isNotEmpty left: value: simple: AutoFocus.SamplesResults.SHA256 iscontext: true - - operator: notInList left: value: simple: AutoFocus.SamplesResults.SHA256 iscontext: true right: value: simple: inputs.SHA256 iscontext: true ignorecase: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 840, "y": 955 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 850, "width": 1040, "x": 840, "y": 345 } } } inputs: - key: FileHash value: {} required: false description: "One or more file hashes to search for in Autofocus simple mode search. Supports MD5, SHA1, and SHA256 file hashes. \n\nSeparate multiple search values by commas only (without spaces or any special characters)." playbookInputQuery: - key: Search Type value: {} required: true description: "Which Autofocus search types should be executed. \n\nPossible values are session, sample, tag, or all. Session and sample are the recommended search types for this playbook. \n\nSample-based search detects threat indicators or identifiers within samples sent to WildFire for analysis. \n\nSession-based search detects threat indicators or identifiers within various context details and session data provided by samples during sample submission. \n\nTag-based search identifies the most popular tags." playbookInputQuery: - key: Scope value: {} required: true description: Search scope for sample and session. Possible values are industry, organization, global, or all. playbookInputQuery: - key: SampleQuery value: {} required: false description: |- Use the Autofocus advanced search mode to leverage a variety of query options in a sample search. Advanced search requires you to specify all field names, parameters, and operators. The query currently supports only JSON format which can be extracted from the Autofocus web console API radio button. playbookInputQuery: - key: Sample first seen value: {} required: false description: |- Narrow down a sample-based search by specifying the timestamp samples were first uploaded to WildFire for analysis (indicators will be searched within samples after this timestamp). Specify the time in ISO 8601 format, for example, 2019-09-12T00:00:00. playbookInputQuery: - key: Sample last modified value: {} required: false description: |- Narrow down a sample-based search by specifying the timestamp samples were last modified (indicators will be searched within samples after this timestamp). Specify the time in ISO 8601 format, for example, 2019-09-12T00:00:00. playbookInputQuery: - key: SessionQuery value: {} required: false description: |- Use the Autofocus advanced search mode to leverage a variety of query options in a session search. Advanced search requires you to specify all field names, parameters, and operators. The query currently supports only JSON format which can be extracted from the Autofocus web console API radio button. playbookInputQuery: - key: Sessions time before value: {} required: false description: |- Narrow down a session-based search by specifying the query end timestamp (indicators will be searched within sessions before this timestamp). Specify the time in ISO 8601 format, for example, 2019-09-12T00:00:00. playbookInputQuery: - key: Sessions time after value: {} required: false description: |- Narrow down a session-based search by specifying the query start timestamp (indicators will be searched within sessions after this timestamp). Specify the time in ISO 8601 format, for example, 2019-09-12T00:00:00. playbookInputQuery: - key: Wildfire Verdict value: {} required: false description: "Filter results by WildFire classification assigned to samples based on properties, behaviors, and activities observed for files or email links during static and dynamic analysis.\n\nPossible values are malware, benign, phishing, and greyware. " playbookInputQuery: outputs: - contextPath: Autofocus.Samples.HuntingResults description: Sample objects containing relevant fields. type: string - contextPath: Autofocus.Samples.HuntingResults.Created description: The date the file was created. type: date - contextPath: Autofocus.Samples.HuntingResults.Finished description: The date the file was finished. type: date - contextPath: Autofocus.Samples.HuntingResults.FileName description: The name of the file. type: string - contextPath: Autofocus.Samples.HuntingResults.FileType description: The file type. type: string - contextPath: Autofocus.Samples.HuntingResults.SHA1 description: The SHA1 hash of the file. type: string - contextPath: Autofocus.Samples.HuntingResults.SHA256 description: The SHA256 hash of the file. type: string - contextPath: Autofocus.Samples.HuntingResults.MD5 description: The MD5 hash of the file. type: string - contextPath: Autofocus.Samples.HuntingResults.Region description: The region of the sample. type: string - contextPath: Autofocus.Samples.HuntingResults.Tags description: The tags attached to the sample. type: string - contextPath: Autofocus.Samples.HuntingResults.TagGroups description: The groups of relevant tags. type: string - contextPath: Autofocus.Samples.HuntingResults.Verdict description: The verdict of the sample. type: number - contextPath: Autofocus.Samples.HuntingResults.Artifact.confidence description: The decision confidence. type: string - contextPath: Autofocus.Samples.HuntingResults.Artifact.indicator description: The indicator that was tested. type: string - contextPath: Autofocus.Samples.HuntingResults.Artifact.indicator_type description: 'The indicator type, for example: Mutex, User agent, IPv4, Domain.' type: string - contextPath: Autofocus.Samples.HuntingResults.Artifact.b description: How many set the artifact as benign. type: string - contextPath: Autofocus.Samples.HuntingResults.Artifact.g description: How many set the artifact as grayware. type: string - contextPath: Autofocus.Samples.HuntingResults.Artifact.m description: How many set the artifact as malicious. type: string - contextPath: Autofocus.Sessions.HuntingResults description: Session objects containing relevant fields. type: string - contextPath: Autofocus.Sessions.HuntingResults.Seen description: The seen date. type: date - contextPath: Autofocus.Sessions.HuntingResults.UploadSource description: The source of the uploaded sample. type: string - contextPath: Autofocus.Sessions.HuntingResults.ID description: The ID of the session. Used to get session details. type: string - contextPath: Autofocus.Sessions.HuntingResults.FileName description: The name of the file. type: string - contextPath: Autofocus.Sessions.HuntingResults.FileURL description: The URL of the file. type: string - contextPath: Autofocus.Sessions.HuntingResults.SHA256 description: The SHA256 hash of the file. type: string - contextPath: Autofocus.Sessions.HuntingResults.Industry description: The related industry. type: string - contextPath: Autofocus.Sessions.HuntingResults.Region description: The regions of the sessions. type: string - contextPath: Autofocus.Sessions.HuntingResults.Tags description: The relevant tags. type: string - contextPath: Autofocus.Sessions.HuntingResults.app description: The associated application name. type: string - contextPath: Autofocus.Sessions.HuntingResults.dst_ip description: The associated destination IP. type: string - contextPath: Autofocus.Sessions.HuntingResults.src_ip description: The associated source IP. type: string - contextPath: Autofocus.Sessions.HuntingResults.dst_countrycode description: The associated destination country code. type: string - contextPath: Autofocus.Sessions.HuntingResults.src_countrycode description: The associated source country code. type: string - contextPath: Autofocus.Sessions.HuntingResults.dst_port description: The associated destination port number. type: number - contextPath: Autofocus.Sessions.HuntingResults.src_port description: The associated source port number. type: number - contextPath: Autofocus.Sessions.HuntingResults.user_id description: The recipient user ID. type: string tests: - No tests (auto formatted) fromversion: 6.5.0 supportedModules: - agentix - xsiam