History of groups involved in an attack?

jermomiu — Wed, 01 Feb 2023 15:25:21 GMT

Hello,

when an attack occurs, where can I find the entire history of groups that where involved in that attack? Can I see that in Wildifre maybe or is it AutoFocus that is needed for that?

Thanks.

Re: History of groups involved in an attack?

kiwi — Wed, 08 Feb 2023 10:55:14 GMT

Hi @jermomiu ,

You can manually go through all the logs but that's quite troublesome and time consuming.

Autofocus can help you with that. It enables you to easily identify critical attacks, so that you can triage effectively and take action without requiring additional IT resources. It correlates data from WildFire, the PAN-DB URL Filtering database, Unit 42, and from third-party feeds.

However, Autofocus is end-of-sale as of September 2022 (but still supported until 2025).

For alternatives to Autofocus you might want to look into Cortex XSOAR TIM or AIOps for NGFW

Autofocus end-of-sale FAQ and Alternatives

Kind regards,

-Kiwi

topic Re: History of groups involved in an attack? in General Topics

History of groups involved in an attack?

Re: History of groups involved in an attack?