topic Re: New Security Rule. in Splunk Search

How do I create a dashboard to log any New Firewall rule that has been committed to Panorama?

SPLKwame28 — Tue, 09 Aug 2022 13:53:41 GMT

Creating A dashboard to log any New Firewall rule that has been committed to Panorama. How do i go about this? Any assistance will be greatly appreciated. Thanks

Re: New Security Rule.

gcusello — Sun, 07 Aug 2022 05:48:35 GMT

Hi @SPLKwame28,

your questions is too vague to answer.

Could you better describe your needs:

splunk version?
have you already ingested logs or not?
have you persed them?
did you installed the panorama App (https://splunkbase.splunk.com/app/5831/)?
do you know SPL or not ?if not follow the Splunk Search Tutorial (https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchTutorial),

Ciao.

Giuseppe

Re: New Security Rule.

SPLKwame28 — Wed, 10 Aug 2022 19:44:00 GMT

@gcusello We already have logs from panorama to splunk. I want to setup a dashboard/table in splunk to be able to see new rule or modified rules. I do monthly audit to remove or modify any new rule for our panorama cleanup. Trying to find a way to simplify this. I appreciate your help here.

Thank you.

Re: New Security Rule.

gcusello — Thu, 11 Aug 2022 06:25:20 GMT

Hi @SPLKwame28,

if you already have logs from Panorama, and you correctly parsed them (I suppose you're using Palo Alto networks Add-On - https://splunkbase.splunk.com/app/2757/), you could daily list all the rules and save results in a lookup and then check the active rules.

In other words, you should have a field called "rule", so you could schedule a search (e.g every night) like the following:

index=your_index earliest=30d@d latest=@d | eval day=if(_time<now()-86400,"last_day","previous_days") | stats dc(day) AS day_count values(day) AS day BY rule | eval status=case(day_count=2,"present in the last day and before",day="previous_days","present only in previous days",day="last_day", "New rule") | table rule status

And have the situation of the last 30 days.

Ciao.

Giuseppe

Re: New Security Rule.

SPLKwame28 — Fri, 12 Aug 2022 17:34:37 GMT

@gcusello this really helped to get those rules on panorama. Modified it with the Fisrttime>now()

| eval day=if(firstTime>now()-86400,"last_day","previous_day")

it really helped . i will keep you posted on the outcome.

Thanks

Re: New Security Rule.

gcusello — Sat, 13 Aug 2022 08:05:47 GMT

Hi @SPLKwame28 ,

if one answer solves your need, please accept one answer for the other people of Community or tell us how we can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors;-)

Re: New Security Rule.

gcusello — Thu, 18 Aug 2022 07:04:57 GMT

Hi @SPLKwame28 ,

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors;-)