Build an AutoFocus Export List

Drill down to view the details for
WildFire
samples returned in an AutoFocus search.
Begin a new search.
Click a sample hash to view sample details.
Select an operating system to view activities and behaviors observed when the sample was executed in that WildFire analysis environment.

Add artifacts to an export list:
To add a single artifact to an export list, click the drop-down for the artifact and select
Add to Export List
:

Select multiple artifacts from a WildFire analysis category to add to an export list.
Click the drop-down for a WildFire analysis category and select
Select for Export List
. This turns the drop-downs next to the artifacts into checkboxes.

Select one or more artifacts from the list.
Re-open the options for the category and select
Add Selected to Export List
.

Add all artifacts, all suspicious artifacts, or all highly suspicious artifacts listed for an activity or behavior category to an export list.

Only artifacts that were observed for the selected operating system are added to the export list. To add sample artifacts from a different operating system, repeat Step 1.3 using a different OS option and continue.
Select an export list for the artifacts.
Add artifacts to a new export list:
Enter a name for the new export list.

Click

create new

. This adds the artifact to the new export list.


Add an artifact to an existing export list:

View all artifacts added to an export list.
Click
Exports
on the navigation pane and select the export list to which the artifacts were added in Step 3.

To view the latest artifacts added, select
Sort by: Added Time
, and click
Sort Descending
.

You can also view artifacts based on the WildFire analysis
Section
from which the artifact is derived. For example, a domain in the export list might have been added from the DNS Activity that WildFire detected for the sample. See the Artifact Types that can appear in each WildFire analysis section.
You can click any of the column headers to sort the export list in ascending (up arrow) or descending (down arrow) order.
(
Optional
) Remove artifacts from an export list.
Select artifacts you want to remove and click
Delete Selected Items
.
To remove all artifacts from an export list, you do not have to select all the artifacts; you can simply click
Delete All Items
. Deleting all artifacts also automatically deletes the export list.
Prepare a version of the export list to export out of AutoFocus.
Create a CSV File from the export list.