AutoFocus SOAR Integration

April 26, 2025 ยท View on GitHub

This document details the tools provided by the AutoFocus SOAR integration.

Tools

auto_focus_hunt_ip

Hunt an IP address and retrieve a list of associated tags

Parameters:

  • case_id (str, required): The ID of the case.
  • alert_group_identifiers (List[str], required): Identifiers for the alert groups.
  • target_entities (List[TargetEntity], optional, default=[]): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (str, optional, default="All entities"): Defines the scope for the action.

auto_focus_hunt_domain

Hunt a domain and retrieve a list of associated tags

Parameters:

  • case_id (str, required): The ID of the case.
  • alert_group_identifiers (List[str], required): Identifiers for the alert groups.
  • target_entities (List[TargetEntity], optional, default=[]): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (str, optional, default="All entities"): Defines the scope for the action.

auto_focus_ping

Test connectivity to AutoFocus

Parameters:

  • case_id (str, required): The ID of the case.
  • alert_group_identifiers (List[str], required): Identifiers for the alert groups.
  • target_entities (List[TargetEntity], optional, default=[]): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (str, optional, default="All entities"): Defines the scope for the action.

auto_focus_hunt_file

Hunt a file and retrieve a list of associated tags

Parameters:

  • case_id (str, required): The ID of the case.
  • alert_group_identifiers (List[str], required): Identifiers for the alert groups.
  • target_entities (List[TargetEntity], optional, default=[]): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (str, optional, default="All entities"): Defines the scope for the action.

auto_focus_hunt_url

Hunt a URL and retrieve a list of associated tags

Parameters:

  • case_id (str, required): The ID of the case.
  • alert_group_identifiers (List[str], required): Identifiers for the alert groups.
  • target_entities (List[TargetEntity], optional, default=[]): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (str, optional, default="All entities"): Defines the scope for the action.