This procedure describes how to configure incoming feeds for a particular feed data source, transport type, or content type.
For more information about configuring common options shared across all incoming feeds, see Configure incoming feeds general options.
Palo Alto Autofocus Hash Feed
AutoFocus Malware JSON
Hash indicators with their associated extracts and tags.
The feed provides hash indicators with their associated tags and hash observables.
Palo Alto Networks Auto Focus Threat Intelligence feed
is compatible with EclecticIQ Platform release 2.x and later.
Users need an API key for their own configuration. Sign up and subscribe to the service to obtain the required API key credentials.
Configure the incoming feed
Create and edit an incoming feed.
From the Transport type drop-down menu, select Palo Alto Autofocus Hash Feed.
From the Content type drop-down menu, select AutoFocus Malware JSON.
The API URL field is automatically filled in with the default domain for the endpoint.
You can add a proxy or set up ports according to your needs.
Default value: https://autofocus.paloaltonetworks.com/.
In the API key field, enter your API key.
The SSL verification checkbox is automatically selected.
In the Path to SSL certificate field, if you have client side certification: enter the path to your PEM file.
If not, leave the field empty.
Click the Start ingesting from field, and use the drop-down calendar to select an initial date and, where available, an initial time to fetch content from the intelligence provider/data source starting from a specific date in the past.
By default, the max. amount of days in the past per each query/request is set to 365 days.
If you set an ingestion start date at a point in time further back in the past, the feed sends multiple requests to retrieve the data.
To store your changes, click Save; to discard them, click Cancel.