topic Re: Filtering PaloAlto events in Splunk Search

Filtering PaloAlto events

Gene — Tue, 08 Jun 2021 10:06:08 GMT

Dear Splunkers, can you please help with the following problem:

We use single instance and PaloAlto logs are sent through udp. We have a lot of noisy events which I want to send to nullQueue. I have created props.conf and transforms.conf files:
props:
[pan:threat]
TRANSFORMS_drop = discard_info

Transforms:
[discard_info]
REGEX = ,informational,
DEST_KEY = queue
FORMAT = nullQueue

short part of log, that contains "informational" which I want to filter: ,business-and-economy,informational,client-to-server,6966642515657316810,

For now events are not filtered out and I have no clue how to make it working, will really appreciate your help!

Re: Filtering PaloAlto events

richgalloway — Tue, 08 Jun 2021 13:11:36 GMT

Did you restart Splunk after changing the .conf files? Does the incoming data have the expected sourcetype (pan:threat)?

Re: Filtering PaloAlto events

Gene — Tue, 08 Jun 2021 13:23:59 GMT

Yes, I did. I have fixed problem by changing REGEX:
[discard_info]
REGEX = ^.*(THREAT,url,).*(informational).*$
DEST_KEY = queue
FORMAT = nullQueue

And also I have found that sourcetype needs to be pan:logs because with pan:thread - it is not working.

For now have additional problem trying to filter also events of pan:traffic and after editing transforms.conf file with additional stanza :
[discard_traffic]
REGEX = ^.*(TRAFFIC,end).*(informational).*$
DEST_KEY = queue
FORMAT = nullQueue

and adding in props.conf discard_traffic - everything stops working... So I'm trying to figure out why this is happening

Re: Filtering PaloAlto events

richgalloway — Tue, 08 Jun 2021 15:52:56 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.