Autofocus and minemeld

[Sarou22]

Hello, I don't understand what the Autofocus service is doing.

What is the goal ? It provides the list of attacks present in a corporate network? How do you connect the firewall and the Autofocus service?

I also do not understand what the Minemeld service is doing? 

It provides the indicators, for example: the number of attacks suffered by a company? What it's the

goal ?

Thank you

[BPry]

@Sarou22,

Since this is really basic service overview discussions, I would really recommend either reading Palo Alto Networks data sheet on these products or engaging your account team for an overview. That way you can get all of your questions answered as they are doing the product demo and it'll make more sense.

If you don't want to engage your sales team and want to learn more about a particular product, take a look at the products admin guide. That's going to have a basic overview introduction section that describes what the product or service actually does. 

As for for a brief overview:

AutoFocus:

AutoFocus is all about threat intelligence and providing contextual information and correlation between events across your network. So it takes in all of the threat feeds from Cortex XDR agents you may have deployed, firewalls, WildFire, Prisma Access, ect. and provides additional context and alerting around all of the different events you are seeing on the network. 

MineMeld:

MineMeld is all about combining indicators from different sources and allowing you to feed those all back out in a processed easy to consume fashion. While it's used a lot to block resources across the network through mining blocklists of various types, you can just as easily use it to automatically pull in things like Azure or AWS service IPs.