Autofocus and minemeld

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Autofocus and minemeld

L1 Bithead
Hello, I don't understand what the Autofocus service is doing.
What is the goal ? It provides the list of attacks present in a corporate network? How do you connect the firewall and the Autofocus service?
I also do not understand what the Minemeld service is doing? 
It provides the indicators, for example: the number of attacks suffered by a company? What it's the
goal ?
Thank you

Cyber Elite
Cyber Elite


Since this is really basic service overview discussions, I would really recommend either reading Palo Alto Networks data sheet on these products or engaging your account team for an overview. That way you can get all of your questions answered as they are doing the product demo and it'll make more sense.

If you don't want to engage your sales team and want to learn more about a particular product, take a look at the products admin guide. That's going to have a basic overview introduction section that describes what the product or service actually does. 


As for for a brief overview:



AutoFocus is all about threat intelligence and providing contextual information and correlation between events across your network. So it takes in all of the threat feeds from Cortex XDR agents you may have deployed, firewalls, WildFire, Prisma Access, ect. and provides additional context and alerting around all of the different events you are seeing on the network. 



MineMeld is all about combining indicators from different sources and allowing you to feed those all back out in a processed easy to consume fashion. While it's used a lot to block resources across the network through mining blocklists of various types, you can just as easily use it to automatically pull in things like Azure or AWS service IPs. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!