AutoFocus Search Session activity

The AutoFocus Search Session workflow activity uploads information from an IP address assigned to a security incident to AutoFocus and queues it for a search query. When the activity executes, it queues a search query with AutoFocus for gathering information for a specified source IP. If AutoFocus has previously identified sessions originating from that IP address, a JSON-formatted report is returned.

Input variables

Input variables determine the initial behavior of the activity.

Table 1. Input variables
Variable Description
searchSessionQuery [string] The search query for session information.

Output variables

The output variables contain data that can be used in subsequent activities.

Table 2. Output variables
Variable Description
requestStatus [Boolean] True if a search query was scheduled for execution in AutoFocus.
error [string] The error, if any, that occurred in the activity.
afcookie [string] An identifier for the AutoFocus search query used by the Fetch Search Results activity to retrieve the search results.