So I modified the original threat collect search, replacing the first section
`pan_index` NOT "THREAT,url"
With:
index=pan_logs sourcetype=pan_threat OR sourcetype=pan_traffic [search `pan_threat` | return 1000 session_id] NOT "THREAT,url" | transaction session_id
This gets the session ID acquired from the threat logs, matches them up with the session ID from the traffic logs, and returns the output as one line. This is because threat logs don't contain byte information which was interfering with the dashboards. Has anyone else experienced this, or more to the point, is there a more efficient way to go about this?
Quick edit: I placed '|dedup Session' at the end of the macro otherwise I would get multiple session results.
... View more