Indicators

The Indicators tab is a summary of Threat Indicators that AutoFocus found in the samples returned as search results. Not all sample artifacts are indicators; the Indicators tab only lists artifacts that AutoFocus has determined to be indicators through a statistical algorithm based on the tendency of the artifact to be seen predominantly in malware samples.
Indicators List Details
indicator-drilldown.png
postit1.png
The Indicators tab only displays indicators drawn from the page of sample search results that you are currently viewing. For example, if your search returns 5 pages of search results and you are viewing the second page, the Indicators tab will only display indicators from that second page of samples. AutoFocus also filters the indicators by the scope you have selected for viewing the sample search results (view only
My Samples
,
Public Samples
, or
All Samples
).
postit2.png
AutoFocus groups the indicators by type:
  • Domain
  • IPv4
  • Mutex
  • URL
  • User agent
postit3.png
For each indicator, you can view the number of global malware, grayware, and benign samples in which it was detected. AutoFocus highlights indicators that are Suspicious or Highly Suspicious.
You can export a complete list or only the
Suspect
or
Highly Suspect
indicators by selecting the appropriate export option from the drop down menu ( dropdown.png ). For more information on using the page export options, see Export AutoFocus Page Content.
Indicators matching those forwarded to AutoFocus through MineMeld are marked with an indicator tag ( indicator-tag.png ), which specifies the number of matching indicators. Click on the indicator tag to view the full list of matches.
postit4.png
Each indicator lists the SHA256 hash of the sample(s) in which it was detected. Click on a hash to view sample details.
postit5.png
When you hover over an indicator, a drop down menu ( dropdown.png ) displays. Click on the drop down to open additional tasks. From here, you can:
  • Add to Search
    —Adds a condition to an existing search using the selected indicator value.
  • Add to New Search
    —Opens a new search window and adds a search condition using the selected indicator value.
  • Domain and URL info
    (IP addresses and domains only)—Retrieve detailed information about the indicator from PAN-DB.

Related Documentation