---
title: Get AutoFocus Session Info Enrichment Flow
description: When the Security Operations Palo Alto Networks- Get AutoFocus Session Info Enrichment flow is executed, it queues a search query with AutoFocus for gathering information about a specified source IP. If AutoFocus has knowledge about previous sessions originating from that IP address, a JSON-formatted report is returned.The AutoFocus Search Session flow action uploads information from an IP address assigned to a security incident to AutoFocus and queues it for a search query.The Fetch Search Results flow action fetches search results identified by a cookie to the search query initiated by the AutoFocus Search Session action.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/search-for-malicious-content.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 2
breadcrumb: [Palo Alto Networks - AutoFocus integration, Security Incident Response integrations, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Get AutoFocus Session Info Enrichment Flow

When the **Security Operations Palo Alto Networks- Get AutoFocus Session Info Enrichment** flow is executed, it queues a search query with AutoFocus for gathering information about a specified source IP. If AutoFocus has knowledge about previous sessions originating from that IP address, a JSON-formatted report is returned.

## Before you begin

Role required: sn\_si.analyst

## About this task

The **Security Operations Palo Alto Networks- Get AutoFocus Session Info Enrichment** flow is executed when the **Source IP** field in a security incident is modified and the record is updated. The flow fetches the IP address and submits a query request to AutoFocus. If AutoFocus has previously identified sessions originating from the IP address, a JSON-formatted report is returned.

## Procedure

1.  Navigate to **All** > **Security Incident** > **Show Open Incidents**.

2.  Select the **Indicators of Compromise** tab and populate the **Source IP** field.

3.  Select **Update**.

    AutoFocus scans the information from the IP address and a text file in JSON format is attached to the security incident.

    Actions specific to this integration are described here. For more information on other actions, see [Common Security Operations integration flows and orchestration activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/common-wf-activities.md).


## AutoFocus Search Session action

The **AutoFocus Search Session** flow action uploads information from an IP address assigned to a security incident to AutoFocus and queues it for a search query.

### Input variables

**Note:**

When the action executes, it queues a search query with AutoFocus for gathering information for a specified source IP. If AutoFocus has previously identified sessions originating from that IP address, a JSON-formatted report is returned.

Input variables determine the initial behavior of the action.

|Variable|Description|
|--------|-----------|
|searchSessionQuery \[string\]|The search query for session information.|

## Fetch Search Results action

The **Fetch Search Results** flow action fetches search results identified by a cookie to the search query initiated by the **AutoFocus Search Session** action.

### Input variables

Input variables determine the initial behavior of the action.

|Variable|Description|
|--------|-----------|
|afcookie \[string\]|The AutoFocus cookie for the search request generated by the [AutoFocus Search Session action](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/search-for-malicious-content.md).|

### Output variables

The output variables contain data that can be used in subsequent actions.

|Variable|Description|
|--------|-----------|
|searchPending \[Boolean\]|True if the search request is still processing in AutoFocus.|
|result \[string\]|The search results data.|
|status \[Boolean\]|True if the search is completed and results have been successfully generated.|
|error \[string\]|The error, if any, that occurred in the action.|