Unable to see threat details, can still see traffic logs.

[bbsoc]

We are currently only able to see several threats (not all of them for a given timeframe) on the threat details page, and clicking on a threat from the pie chart which should open the threat details returns nothing. We have tried this with default settings and with versions 3.0, 3.2, and 4.0 of this app. That being said, we are still able to see traffic on all levels, so we know we are receiving logs.

What further information would be needed to help resolve this issue? Are there any other things I can take a poke at?

Thank you

[bbsoc · Accepted solution]

So I modified the original threat collect search, replacing the first section

`pan_index` NOT "THREAT,url"

With:

index=pan_logs sourcetype=pan_threat OR sourcetype=pan_traffic [search `pan_threat`  | return 1000 session_id] NOT "THREAT,url" | transaction session_id

This gets the session ID acquired from the threat logs, matches them up with the session ID from the traffic logs, and returns the output as one line. This is because threat logs don't contain byte information which was interfering with the dashboards. Has anyone else experienced this, or more to the point, is there a more efficient way to go about this?

Quick edit: I placed '|dedup Session' at the end of the macro otherwise I would get multiple session results.