AutoFocus is a cloud-based threat intelligence service that enables you to easily identify critical attacks, so that you can triage effectively and take action without requiring additional IT resources. AutoFocus correlates threat data from your network, industry, and global intelligence feeds, and surfaces what’s most important. This includes giving you a direct pipeline to actionable intelligence from Unit 42, the Palo Alto Networks threat research team—AutoFocus lets you know if adversaries and campaigns discovered by Unit 42 have targeted your network, or networks like yours.
|August 2021||AutoFocus™ support for MineMeld has reached end-of-life and will no longer be accessible from the AutoFocus portal. For more information about migration to the Cortex XSOAR Threat Intel Management platform or alternative solutions, refer to the MineMeld End-of-Life Announcement.|
|May 2021||The AutoFocus™ search mechanism has been improved to optimize performance and reliability.|
AutoFocus™ now integrates analysis and session data from samples uploaded to the WildFire cloud from Cortex XDR. This provides a centralized view of all your upload sources to help your organization assess the attack surface and specific attack vectors that make your organization vulnerable to threats.
The AutoFocus™ search now incorporates analysis data derived from the improved URL analysis capabilities found in the WildFire global cloud.
|Looking for more?||See what else we've been working on...|
AutoFocus™ is a threat intelligence service that provides an interactive, graphical interface for analyzing and contextualizing the threats your network faces. AutoFocus especially helps you to keep up with threat trends related to targeted cyberattacks, so that you can take a preventive approach to securing your network. The AutoFocus Administrator's Guide gives you everything you need to get started with AutoFocus: learn about how AutoFocus works, set up meaningful alerts for advanced attacks, and even use AutoFocus IoCs to enforce security policy on a Palo Alto Networks firewall.
Learn all about the latest features in AutoFocus, the Palo Alto Networks threat intelligence service. For each new feature we describe, we've also included steps to get started. You'll also find a list of open issues that we’re working on to improve your AutoFocus experience.
The AutoFocus™ API extends the ability to query the threat intelligence cloud through a programmatic, RESTful API. You can integrate this API into a third-party service, application, or script that accesses AutoFocus outside of the web portal. API responses are in JSON or XML-based STIX format.