Ip Reputation app: pans_logs data source

[65pony]

We have installed the "IP Reputation" app and after having some issues seeing data we discovered that the pan_logs index was not being populate. After some research we discovered that PAN stands for "Palo Alto Networks", which we do not use. Soooo,I am assuming we need to consume our firewall logs into this index for the app to work. If this correct?

Question for the app owner: If would be helpful if there were directions on what needs to be populated in the pan_logs index.

[mmaier_splunk]

Hi,

with the latest update 1.0 the dashboard is now CIM compliant. so you can map any data which matches the network traffic CIM description. use the CIM App to verify your TA's and Field Extractions work correctly. If you get output on allowed network traffic in your pivot your dashboard threat map and critical network traffic analyzer within this app will work.

br
matthias

[mmaier_splunk]

Hi,

the Threat Dashboard is linked to the palo alto apps as the author (me ;-)) is using a virtual palo alto firewall for development and validation of the app. so you can just edit the searches or the event-type used to map it to your fields. however some time i might update the app with CIM compliant fields.

br
matthias