topic Palo log issue in Splunk Enterprise Security

Palo log issue

Splunkers2 — Wed, 11 Sep 2024 01:51:14 GMT

Hi all,

I'm having issues comparing user field in Palo Alto traffic logs vs last user reported by Crowdstrike/Windows events.Palo-Alto traffic logs is showing a different user in logs initiating the traffic during the time window compared to Crowd strike last user login reported for same endpoint.

Has anyone you know faced similar issue ?

Thanks

Re: Palo log issue

dural_yyz — Fri, 13 Sep 2024 14:56:38 GMT

Since both of these are data source content issues it's difficult to determine from the Splunk side. I would start with more research at a specific machine side. What traffic is being generated and from what application. Who if anyone is logged in live.

Re: Palo log issue

inventsekar — Sat, 14 Sep 2024 05:26:00 GMT

Hi @Splunkers2 May we know if you use the CIM pls.

pls copy paste the Splunk Search query you used(remove sensitive data beofre), thanks

Re: Palo log issue

PickleRick — Sat, 14 Sep 2024 08:31:23 GMT

If I understand correctly what you're saying, it's not a problem with Splunk but rather with quality of your data. If the same "truth" in reality is expressed as events saying different things in Splunk it means there's something wrong with your sources setup.