Skip to main content

Autofocus - Traffic Indicators Hunting

This Playbook is part of the AutoFocus by Palo Alto Networks Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.5.0 and later.

The playbook queries the PANW Autofocus session and samples log data for traffic indicators such as URLs, IP addresses, and domains.

A simple search mode queries Autofocus based on the traffic indicators specified in the playbook inputs. Advanced search mode queries can also be used with multiple query parameters, but require all field names, parameters, and operators (JSON format) to be specified. We recommended using the Autofocus UI to create an advanced query, exporting it, and pasting it into the relevant playbook inputs.

Note that multiple search values should be separated by commas only (without spaces or any special characters).

Dependencies#

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks#

  • Autofocus Query Samples, Sessions and Tags

Integrations#

This playbook does not use any integrations.

Scripts#

  • SetAndHandleEmpty

Commands#

This playbook does not use any commands.

Playbook Inputs#


NameDescriptionDefault ValueRequired
IPAddressOne or more IP addresses to search for in Autofocus simple mode search.

Separate multiple search values by commas only (without spaces or any special characters).
Optional
URLDomainOne or more URLs and/or domains to search for in Autofocus simple mode search.

Separate multiple search values by commas only (without spaces or any special characters).
Optional
Search TypeWhich Autofocus search types should be executed.

Possible values are session, sample, tag, or all. Session and sample are the recommended search types for this playbook.

Sample-based search detects threat indicators or identifiers within samples sent to WildFire for analysis.

Session-based search detects threat indicators or identifiers within various context details and session data provided by samples during sample submission.

Tag-based search identifies the most popular tags.
session,sampleRequired
ScopeSearch scope for sample and session. Possible values are industry, organization, or global.globalRequired
SampleQueryuse the Autofocus advanced search mode to leverage a variety of query options within a sample search. Advanced search requires you to specify all field names, parameters, and operators.

The query currently supports only JSON format which can be extracted from the Autofocus web console API radio button.
Optional
Sample first seenNarrow down a sample-based search by specifying the timestamp samples were first uploaded to WildFire for analysis (indicators will be searched within samples after this timestamp).

Specify the time in ISO 8601 format, for example, 2019-09-12T00:00:00.
Optional
Sample last modifiedNarrow down a sample-based search by specifying the timestamp samples were last modified (indicators will be searched within samples after this timestamp).

Specify the time in ISO 8601 format, for example, 2019-09-12T00:00:00.
Optional
SessionQueryUse the Autofocus advanced search mode to leverage a variety of query options in a session search. Advanced search requires you to specify all field names, parameters, and operators.

The query currently supports only JSON format which can be extracted from the Autofocus web console API radio button.
Optional
Sessions time beforeNarrow down a session-based search by specifying the query end timestamp (indicators will be searched within sessions before this timestamp).

Specify the time in ISO 8601 format, for example, 2019-09-12T00:00:00.
Optional
Sessions time afterNarrow down a session-based search by specifying the query start timestamp (indicators will be searched within sessions after this timestamp).

Specify the time in ISO 8601 format, for example, 2019-09-12T00:00:00.
Optional
Wildfire VerdictFilter results by WildFire classification assigned to samples based on properties, behaviors, and activities observed for files or email links during static and dynamic analysis.

Possible values are malware, benign, phishing, and greyware.
Optional

Playbook Outputs#


PathDescriptionType
Autofocus.Samples.HuntingResultsSample objects containing relevant fields.string
Autofocus.Samples.HuntingResults.CreatedThe date the file was created.date
Autofocus.Samples.HuntingResults.FinishedThe date the file was finished.date
Autofocus.Samples.HuntingResults.FileNameThe name of the file.string
Autofocus.Samples.HuntingResults.FileTypeThe file type.string
Autofocus.Samples.HuntingResults.SHA1The SHA1 hash of the file.string
Autofocus.Samples.HuntingResults.SHA256The SHA256 hash of the file.string
Autofocus.Samples.HuntingResults.MD5The MD5 hash of the file.string
Autofocus.Samples.HuntingResults.RegionThe region of the sample.string
Autofocus.Samples.HuntingResults.TagsThe tags attached to the sample.string
Autofocus.Samples.HuntingResults.TagGroupsThe groups of relevant tags.string
Autofocus.Samples.HuntingResults.VerdictThe verdict of the sample.number
Autofocus.Samples.HuntingResults.Artifact.confidenceThe decision confidence.string
Autofocus.Samples.HuntingResults.Artifact.indicatorThe indicator that was tested.string
Autofocus.Samples.HuntingResults.Artifact.indicator_typeThe indicator type, for example: Mutex, User agent, IPv4, Domain.string
Autofocus.Samples.HuntingResults.Artifact.bHow many set the artifact as benign.string
Autofocus.Samples.HuntingResults.Artifact.gHow many set the artifact as grayware.string
Autofocus.Samples.HuntingResults.Artifact.mHow many set the artifact as malicious.string
Autofocus.Sessions.HuntingResultsSession objects containing relevant fields.string
Autofocus.Sessions.HuntingResults.SeenThe seen date.date
Autofocus.Sessions.HuntingResults.UploadSourceThe source of the uploaded sample.string
Autofocus.Sessions.HuntingResults.IDThe ID of the session. Used to get session details.string
Autofocus.Sessions.HuntingResults.FileNameThe name of the file.string
Autofocus.Sessions.HuntingResults.FileURLThe URL of the file.string
Autofocus.Sessions.HuntingResults.SHA256The SHA256 hash of the file.string
Autofocus.Sessions.HuntingResults.IndustryThe related industry.string
Autofocus.Sessions.HuntingResults.RegionThe regions of the sessions.string
Autofocus.Sessions.HuntingResults.TagsThe relevant tags.string
Autofocus.Sessions.HuntingResults.appThe associated application name.string
Autofocus.Sessions.HuntingResults.dst_ipThe associated destination IP.string
Autofocus.Sessions.HuntingResults.src_ipThe associated source IP.string
Autofocus.Sessions.HuntingResults.dst_countrycodeThe associated destination country code.string
Autofocus.Sessions.HuntingResults.src_countrycodeThe associated source country code.string
Autofocus.Sessions.HuntingResults.dst_portThe associated destination port number.number
Autofocus.Sessions.HuntingResults.src_portThe associated source port number.number
Autofocus.Sessions.HuntingResults.user_idThe recipient user ID.string

Playbook Image#


Autofocus - Traffic Indicators Hunting