All Apps and Add-ons

No Palo Alto Wildfire report data in Splunk Cloud

awesomeguan
New Member

Hi,
After following steps in WildFire in below url https://splunk.paloaltonetworks.com/wildfire.html
Add the Wildfire API key
There is no data seen in Splunk Cloud.
Please help to check Wildfire side to see if there any error message when Splunk Cloud tried to talk to it.

By the way, we also send the Panorama logs via on-premise Splunk heavy forwarder to Splunk Cloud and it's working as designed.

Thank you.

0 Karma

awesomeguan
New Member

Answers from Palo Alto support:

Regarding Splunk-Palo Alto networks App, kindly be advised that this is a developer supported application so it is not supported by through this channel TAC

In order to receive support for your Splunk app

https://splunk.paloaltonetworks.com/support.html
(reference https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CllZCAS)

Anyway for courtesy checking, the WildFire API key on our Splunk App will not be used unless there are WildFire logs coming from the Firewall or Panorama (it is just used for enriching the raw log with WildFIre analysis report from the cloud as per documentation).

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...