All Apps and Add-ons

Does Palo Alto Networks Add-on for Splunk parse only SYSTEM messages?

stanislavmerzly
Engager

Hello!

I send events from PaloAlto Panorama to Splunk, and I have a problem.

I install the PaloAlto Add-on, but it doesn't work properly for me.

If i use my custom sourcetype, i see a lot of events, nearly 1000 in second.

If i use pan:firewall sourcetype - i see no events.

If i use pan:log sourcetype - i see only pan:system messages, for example like this (without [] brackets):

[<14>Feb 7 22:11:46 my-domain 1,2019/02/07 22:11:45,000702397372,SYSTEM,tls,0,2019/02/07 22:11:45,,panorama-auth-success,,0,0,general,informational,"Client authentication successful PAN-OS ver: 8.0.4 Panorama ver:8.1.5 Client IP: x.x.x.x Server IP: y.y.y.y Client CN: 012001003158",387069,0x0,0,0,0,0,,Panorama]

But usually, I receive a lot of protocol-related events (see below); does the App parse it?

[<14>Feb 7 22:12:32 my-domain 1,2019/02/07 22:12:32,001801012275,TRAFFIC,start,1,2019/02/04 16:18:07,x.x.x.x,y.y.y.y,0.0.0.0,0.0.0.0,Dddd,,,bittorrent,vsys1,trust,trust,ethernet1/11,ethernet1/12,Logs,2019/02/04 16:18:07,111853,1,44822,19023,0,0,0x4000,udp,allow,76,76,0,1,2019/02/04 16:18:07,0,any,0,66004439243,0x8000000000000000,x.x.x.x-y.y.y.y,Russian Federation,0,1,0,n/a,11,0,0,0,,spb-pan,from-policy,,,0,,0,,N/A,0,0,0,0]

By the way, you can see panorama version (PAN-OS ver: 8.0.4 Panorama ver:8.1.5). So, i have several PaloAlto NGFW, that sends data to Panotama.

Does anybody have any advice for me on what to do and how it is possible to automatically parse all events?

0 Karma

stanislavmerzly
Engager

I will write an answer for me - i don't know why, but events appears in splunk index after near 45 min. So, i have an 45 min delay before i will see all events.
alt text

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...