topic Re: How to filter out Informational logs from Palo Alto in Splunk Search

How to filter out Informational logs from Palo Alto

cesarfabre — Mon, 22 Apr 2019 11:58:22 GMT

Hi there,

I am trying to filter out Information logs from Palo Alto Firewall using REGEX with props e transforms.conf but it is not working.

Help me with the correct REGEX.

Thanks a lot!
César

Re: How to filter out Informational logs from Palo Alto

richgalloway — Mon, 22 Apr 2019 12:42:08 GMT

Please provide some sample events (hide private data) and your current props and transforms settings.

Re: How to filter out Informational logs from Palo Alto

cesarfabre — Mon, 22 Apr 2019 17:15:05 GMT

Hi Rich,

Follows the event log:

Apr 22 14:00:57 192.168.x.x 1,2019/04/22 14:00:57,001801010915,THREAT,spyware,2049,2019/04/22 14:00:57,192.168.X.X,74.125.X.X,179.191.X.X,74.125.X.X,EXIT_INTERNET,unknown,,ssl,vsys1,INTER,MUNDI,ethernet1/3.168,ethernet1/4.179,LOG-FORWARD-SPLUNK,2019/04/22 14:00:57,147775,1,51631,443,51644,443,0x423000,tcp,alert,"fonts.gstatic.com/",Suspicious TLS Evasion Found(14978),computer-and-internet-info,informational,client-to-server,73291901,0x2000000000000000,XX,United States,0,,0,,,0,,,,,,,,0,0,0,0,0,FW-XX,PA-XXXX-XXX,,,,,0,,0,,N/A,spyware,AppThreat-8144-5408,0x0,0,4294967295,
host = 192.168.X.X source = udp:5514 sourcetype = pan:threat

My current props and transforms settings:

(1) props.conf file
[pan:log]
TRANSFORMS-drop = discard-nolog

(2) transforms.conf
[discard-nolog]
REGEX = informational.*xlog
DEST_KEY = queue
FORMAT = nullQueue

But this is not working! Not reject informational logs.

Thank you for your help.

Re: How to filter out Informational logs from Palo Alto

richgalloway — Tue, 23 Apr 2019 15:14:48 GMT

The REGEX attribute does not match the sample event. For an event to be rejected it must contain the two strings "informational" and "xlog" with any number of characters between them. The sample event does not contain "xlog".

Re: How to filter out Informational logs from Palo Alto

cesarfabre — Tue, 23 Apr 2019 17:12:28 GMT

Hi Rich,

Sorry, I made a mistake. As I'm indexing the Palo Alto logs I would like support in editing the props and transforms.conf files.

My current props and transforms settings is working well with TRAFFIC filter. See:

(1) props.conf file
[pan:log]
TRANSFORMS-drop = discard-nolog

(2) transforms.conf
[discard-nolog]
REGEX = TRAFFIC.*xlog
DEST_KEY = queue
FORMAT = nullQueue

Now I would like to also filter informational logs from Palo Alto. So, how is the REGEX for this new filter?

Thanks a lot for your help!

César

Re: How to filter out Informational logs from Palo Alto

richgalloway — Tue, 23 Apr 2019 21:53:06 GMT

Try this.

props.conf file

[pan:log]
TRANSFORMS-drop = discard-nolog, discard-info

transforms.conf

[discard-nolog]
REGEX = TRAFFIC.*xlog
DEST_KEY = queue
FORMAT = nullQueue

[discard-info]
REGEX = ,informational,
DEST_KEY = queue
FORMAT = nullQueue

Re: How to filter out Informational logs from Palo Alto

cesarfabre — Thu, 25 Apr 2019 12:22:46 GMT

Hi Rich,

I'm very happy, it worked.

Now I will configure the email to send alerts when critical events occur.

Thanks a lot!

Re: How to filter out Informational logs from Palo Alto

lakshman239 — Thu, 25 Apr 2019 12:36:48 GMT

If you are getting the PA logs via syslog, you can add a rule in your syslog [ rsyslog/syslog-ng] to allow only TRAFIC and THREAT logs and hence you can dispense the props/transforms changes.

Re: How to filter out Informational logs from Palo Alto

richgalloway — Thu, 25 Apr 2019 12:43:23 GMT

@cesarfabre Please accept the answer to help future readers.

Re: How to filter out Informational logs from Palo Alto

cesarfabre — Thu, 25 Apr 2019 16:59:24 GMT

@richgalloway I accepted!!!

Tks