Latest AutoFocus Features

The following topics provide a snapshot of the AutoFocus features introduced in September 2020. This list provides context for the new features, with steps to get started. For information about past releases, refer to AutoFocus Release History.
Support for URL Analysis
The AutoFocus™ search now incorporates analysis data derived from the improved URL analysis capabilities found in the WildFire global cloud. Additionally, this service aggregates threat analysis details from all Palo Alto Networks services, enabling AutoFocus to deliver consistent web page verdicts with additional report details for more context when investigating anomalous web activity.
Report details for URLs processed by the new URL analyzers are viewable when performing an AutoFocus indicator search.
af-url-analysis-search-sample.png
The following improvements are now available for URL searches:
  • Reorganized Report Structure with Additional Analysis Details—URL Analysis reports are organized into three information context tabs:
    • Summary—Provides a high level overview of the URL, including PAN-DB categorization details, detection reasons with verdict, Whois information, accompanied by a screenshot.
    • Evidence—Provides details regarding why and how the verdict was reached.
    • Analyst—Provides various insights into the operational details of the web page, including network traffic and file transfers.
  • Consolidated Verdict—Palo Alto Networks aggregates the threat analysis details to provide a single, standardized verdict across all platforms.
For more information about the concepts referenced in this feature, refer to: AutoFocus Search
Support for Cortex XDR Sample Uploads
Cortex XDR can forward suspicious samples to WildFire for analysis in addition to using its built-in local analysis engine, to provide detailed sample information and behavior analysis. Now in this release, you can search for sessions and their associated samples within AutoFocus to view the WildFire analysis details. You can also filter the contents of your dashboard based on an upload source to create reports with greater specificity.
While Magnifier has been re-branded as Cortex XDR, some of the legacy session data recorded during the Magnifier operating period (and up to 7/13/2020) remains classified as Magnifier; however, Cortex XDR began recording session data starting on 4/7/2020, resulting in a session data overlap. You can configure an AutoFocus search to produce results from both upload sources to get the combined dataset.
af-report-cortex-xdr.png
  • Configure your search to find samples or sessions that were sent to WildFire from Cortex XDR. For example, create a search matching the condition
    Upload Source > is > Cortex XDR
    , and then click
    Search
    .
    af-search-upload-cortex-xdr.png
  • Click on a sample hash to view the sample details. For more information about reviewing and understanding your search results, see Drill Down in Search Results.
For more information about the concepts referenced in this feature, refer to: AutoFocus Search

Recommended For You