Build an AutoFocus Export List

1. Drill down to view the details for WildFire samples returned in an AutoFocus search.
   1. Begin a new search.
   2. Click a sample hash to view sample details.
   3. Select an operating system to view activities and behaviors observed when the sample was executed in that WildFire analysis environment.

2. Add artifacts to an export list:
   To add a single artifact to an export list, click the drop-down for the artifact and select Add to Export List:

   Select multiple artifacts from a WildFire analysis category to add to an export list.
   1. Click the drop-down for a WildFire analysis category and select Select for Export List. This turns the drop-downs next to the artifacts into checkboxes.

   2. Select one or more artifacts from the list.
   3. Re-open the options for the category and select Add Selected to Export List.
   Add all artifacts, all suspicious artifacts, or all highly suspicious artifacts listed for an activity or behavior category to an export list.

   Only artifacts that were observed for the selected operating system are added to the export list. To add sample artifacts from a different operating system, repeat Step 1.3 using a different OS option and continue.
3. Select an export list for the artifacts.
   Add artifacts to a new export list:
   1. Enter a name for the new export list.
   2. Click create new. This adds the artifact to the new export list.

   Add an artifact to an existing export list:

4. View all artifacts added to an export list.
   Click Exports on the navigation pane and select the export list to which the artifacts were added in Step 3.

   • To view the latest artifacts added, select Sort by: Added Time, and click Sort Descending.

   • You can also view artifacts based on the WildFire analysis Section from which the artifact is derived. For example, a domain in the export list might have been added from the DNS Activity that WildFire detected for the sample. See the Artifact Types that can appear in each WildFire analysis section.
   • You can click any of the column headers to sort the export list in ascending (up arrow) or descending (down arrow) order.
5. (Optional) Remove artifacts from an export list.
   • Select artifacts you want to remove and click Delete Selected Items.
   • To remove all artifacts from an export list, you do not have to select all the artifacts; you can simply click Delete All Items. Deleting all artifacts also automatically deletes the export list.
6. Prepare a version of the export list to export out of AutoFocus.
   Create a CSV File from the export list.