All Apps and Add-ons

Does Palo Alto Networks Add-on for Splunk parse only SYSTEM messages?

stanislavmerzly
Engager

Hello!

I send events from PaloAlto Panorama to Splunk, and I have a problem.

I install the PaloAlto Add-on, but it doesn't work properly for me.

If i use my custom sourcetype, i see a lot of events, nearly 1000 in second.

If i use pan:firewall sourcetype - i see no events.

If i use pan:log sourcetype - i see only pan:system messages, for example like this (without [] brackets):

[<14>Feb 7 22:11:46 my-domain 1,2019/02/07 22:11:45,000702397372,SYSTEM,tls,0,2019/02/07 22:11:45,,panorama-auth-success,,0,0,general,informational,"Client authentication successful PAN-OS ver: 8.0.4 Panorama ver:8.1.5 Client IP: x.x.x.x Server IP: y.y.y.y Client CN: 012001003158",387069,0x0,0,0,0,0,,Panorama]

But usually, I receive a lot of protocol-related events (see below); does the App parse it?

[<14>Feb 7 22:12:32 my-domain 1,2019/02/07 22:12:32,001801012275,TRAFFIC,start,1,2019/02/04 16:18:07,x.x.x.x,y.y.y.y,0.0.0.0,0.0.0.0,Dddd,,,bittorrent,vsys1,trust,trust,ethernet1/11,ethernet1/12,Logs,2019/02/04 16:18:07,111853,1,44822,19023,0,0,0x4000,udp,allow,76,76,0,1,2019/02/04 16:18:07,0,any,0,66004439243,0x8000000000000000,x.x.x.x-y.y.y.y,Russian Federation,0,1,0,n/a,11,0,0,0,,spb-pan,from-policy,,,0,,0,,N/A,0,0,0,0]

By the way, you can see panorama version (PAN-OS ver: 8.0.4 Panorama ver:8.1.5). So, i have several PaloAlto NGFW, that sends data to Panotama.

Does anybody have any advice for me on what to do and how it is possible to automatically parse all events?

0 Karma

stanislavmerzly
Engager

I will write an answer for me - i don't know why, but events appears in splunk index after near 45 min. So, i have an 45 min delay before i will see all events.
alt text

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...