All Apps and Add-ons

No Palo Alto Wildfire report data in Splunk Cloud

awesomeguan
New Member

Hi,
After following steps in WildFire in below url https://splunk.paloaltonetworks.com/wildfire.html
Add the Wildfire API key
There is no data seen in Splunk Cloud.
Please help to check Wildfire side to see if there any error message when Splunk Cloud tried to talk to it.

By the way, we also send the Panorama logs via on-premise Splunk heavy forwarder to Splunk Cloud and it's working as designed.

Thank you.

0 Karma

awesomeguan
New Member

Answers from Palo Alto support:

Regarding Splunk-Palo Alto networks App, kindly be advised that this is a developer supported application so it is not supported by through this channel TAC

In order to receive support for your Splunk app

https://splunk.paloaltonetworks.com/support.html
(reference https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CllZCAS)

Anyway for courtesy checking, the WildFire API key on our Splunk App will not be used unless there are WildFire logs coming from the Firewall or Panorama (it is just used for enriching the raw log with WildFIre analysis report from the cloud as per documentation).

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...