topic Re: Splunk and PA cortext data lake in All Apps and Add-ons

Splunk and Palo Alto Cortex Data Lake: Data for global protect cloud service is not getting parsed.

shirishkamat84 — Thu, 20 Aug 2020 22:31:14 GMT

We are ingesting the firewall data from the panorama and GP cloud service logs from Cortex and ingesting the data to the same index pan_logs with sourcetype=pan:log.

The logs from panorama are getting parsed properly, however, the data from the cortex data lake for global protect cloud service is not getting parsed. Does the Palo Alto Networks for Splunk add-on support data coming from Cortex? Any suggestions to make this work?

Re: Splunk and PA cortext data lake

hiren53 — Thu, 20 Aug 2020 21:50:25 GMT

I am trying to get data from cortex data lake to our Splunk hosted on prem. We getting the logs but it’s garbage characters.

splunk is not able to open ssl input. Can you share splunk side config to make this work?

what were the parameters on inputs.conf and what third party CA you user and created pem files?

any help would be appreciated

Re: Splunk and Palo Alto Cortex Data Lake: Data for global protect cloud service is not getting parsed.

swebb07g — Mon, 04 Jan 2021 23:57:19 GMT

I'm also curious about this.

Re: Splunk and PA cortext data lake

swebb07g — Tue, 12 Jan 2021 01:45:51 GMT

I don't think Cortex Data Lake supports SSL (assuming you mean https). It does support syslog over TLS though.

Re: Splunk and PA cortext data lake

swebb07g — Sun, 11 Apr 2021 02:16:05 GMT

In case anyone else lands here, it appears Cortex Data Lake now supports forwarding directly to Splunk via HTTP Event Collector (HEC).

https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-log-forwarding-app/forward-logs-to-an-https-server