All Apps and Add-ons

Unable to see threat details, can still see traffic logs.

bbsoc
Explorer

We are currently only able to see several threats (not all of them for a given timeframe) on the threat details page, and clicking on a threat from the pie chart which should open the threat details returns nothing. We have tried this with default settings and with versions 3.0, 3.2, and 4.0 of this app. That being said, we are still able to see traffic on all levels, so we know we are receiving logs.

What further information would be needed to help resolve this issue? Are there any other things I can take a poke at?

Thank you

0 Karma
1 Solution

bbsoc
Explorer

So I modified the original threat collect search, replacing the first section

`pan_index` NOT "THREAT,url"

With:

index=pan_logs sourcetype=pan_threat OR sourcetype=pan_traffic [search `pan_threat`  | return 1000 session_id] NOT "THREAT,url" | transaction session_id

This gets the session ID acquired from the threat logs, matches them up with the session ID from the traffic logs, and returns the output as one line. This is because threat logs don't contain byte information which was interfering with the dashboards. Has anyone else experienced this, or more to the point, is there a more efficient way to go about this?

Quick edit: I placed '|dedup Session' at the end of the macro otherwise I would get multiple session results.

View solution in original post

0 Karma

bbsoc
Explorer

So I modified the original threat collect search, replacing the first section

`pan_index` NOT "THREAT,url"

With:

index=pan_logs sourcetype=pan_threat OR sourcetype=pan_traffic [search `pan_threat`  | return 1000 session_id] NOT "THREAT,url" | transaction session_id

This gets the session ID acquired from the threat logs, matches them up with the session ID from the traffic logs, and returns the output as one line. This is because threat logs don't contain byte information which was interfering with the dashboards. Has anyone else experienced this, or more to the point, is there a more efficient way to go about this?

Quick edit: I placed '|dedup Session' at the end of the macro otherwise I would get multiple session results.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...