Purpose
This guide explains how to configure the Palo Alto Networks AutoFocus Response integration in Logsign USO, so that an analyst (or an action rule) can look up WildFire/AutoFocus reputation and associated tags for an IP address, URL, file hash, or domain directly from a Logsign Incident. This is a read-only threat-intelligence lookup integration; it does not block or change state anywhere.
Prerequisites
- A Palo Alto Networks AutoFocus license and API key.
Step 1: Obtain Your AutoFocus API Key
- Log in to the AutoFocus portal with your Palo Alto Networks credentials.
- Open your account settings and copy your AutoFocus API key.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for AutoFocus, click Configure then +Device, and fill in:
| Field | Description |
|---|---|
| Device Name | Free-text label identifying this AutoFocus device in Logsign. |
| Api Key | Your AutoFocus API key from Step 1. Not enforced as required by the configuration schema, but functionally necessary; leave it blank and calls will fail authentication. Stored encrypted at rest. |
Click Create to save the device.
Available Methods
- get_ip_address_reputation — reputation and related tags for an IP. Arg: ip_address.
- get_url_reputation — reputation and related tags for a URL. Arg: url.
- get_file_reputation — reputation and related tags for a file hash. Arg: filehash.
- get_domain_reputation — reputation and related tags for a domain. Arg: domain.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401/403 error | Missing, wrong, or revoked Api Key. | Confirm the Api Key field is filled in and matches your AutoFocus account exactly. |
| Quota/rate-limit error | AutoFocus enforces query quotas based on your license tier. | Check your account's remaining query quota in the AutoFocus portal. |
Notes and Limits
- This integration is read-only threat intelligence; it never blocks or changes state anywhere.