Palo Alto App not doing changing sourcetype properly for GlobalProtect log?

[pandacai]

For example, i see Regex to change source type from pan:log to pan:threat as,

REGEX = ^[^,]+,[^,]+,[^,]+,THREAT,

However, the exact piece this regex is seeking for in raw data i am receiving is

,2020/02/21 22:09:08,,TRAFFIC,

With two comma in roll the add on is not doing any sourcetype change then...

I am receiving this logs from Cortex, not sure whether it could do something with it?

Thanks a lot

[h_elakkaoui]

Hello guys,
I'm not a splunk expert, so my solution might not be the optimal. changing the regex @ /opt/splunk/etc/apps/Splunk_TA_paloalto/default/transforms.conf to accomodate both inputs from PA FW and PA CortexDL.
This new regex was generated from splunk field extraction wizard.

[pan_threat]
DEST_KEY = MetaData:Sourcetype

REGEX = ^[^,]+,[^,]+,[^,]+,THREAT,

REGEX = ^^(?:[^,\n]*,){3}THREAT,
FORMAT = sourcetype::pan:threat

[pan_traffic]
DEST_KEY = MetaData:Sourcetype

REGEX = ^[^,]+,[^,]+,[^,]+,TRAFFIC,

REGEX = ^^(?:[^,\n]*,){3}TRAFFIC,
FORMAT = sourcetype::pan:traffic

[pan_system]
DEST_KEY = MetaData:Sourcetype

REGEX = ^[^,]+,[^,]+,[^,]+,SYSTEM,

REGEX = ^^(?:[^,\n]*,){3}SYSTEM,
FORMAT = sourcetype::pan:system

[pan_config]
DEST_KEY = MetaData:Sourcetype

REGEX = ^[^,]+,[^,]+,[^,]+,CONFIG,

REGEX = ^^(?:[^,\n]*,){3}CONFIG,
FORMAT = sourcetype::pan:config

[pan_hipmatch]
DEST_KEY = MetaData:Sourcetype

REGEX = ^[^,]+,[^,]+,[^,]+,HIPMATCH,

REGEX = ^^(?:[^,\n]*,){3}HIPMATCH,
FORMAT = sourcetype::pan:hipmatch

[pan_correlation]
DEST_KEY = MetaData:Sourcetype

REGEX = ^[^,]+,[^,]+,[^,]+,CORRELATION,

REGEX = ^^(?:[^,\n]*,){3}CORRELATION,
FORMAT = sourcetype::pan:correlation

[pan_userid]
DEST_KEY = MetaData:Sourcetype

REGEX = ^[^,]+,[^,]+,[^,]+,USERID,

REGEX = ^^(?:[^,\n]*,){3}USERID,
FORMAT = sourcetype::pan:userid

[pandacai]

thanks a lot your expression also worked perfect:) meanwhile i'm afraid we have to wait for palo alto's decision when to inject a value in serial number field, or they'll change the the app itself as a future solution lol

[panguy · Accepted solution]

This is a known issue with Cortex that is planned to be fixed. The empty value was in place of a serial number. In the future there will be a value here to signify this is coming from Cortex. Temporary work around is to change the REGEX to ^[^,]+,[^,]+,[^,]?+,THREAT,

[pandacai]

Thank you! Sourcetype got changed successfully, while following up field extraction for logs seemed still be failing...

Since the Palo Alto App is also supporting our on premise firewall logs, maybe it's not wise to go further customization. Would there be any estimated time for Cortex fixing?

[shirishkamat84]

We are also having the same issue, we are collecting logs from both on prem FW and from cortex, works fine for on-prem firewalls but field extraction fails. any suggestion how to fix this ?

[pandacai]

neither do we have a solution but to follow panguy's suggestion to manually change sourcetypes - not to be the same as on premise logs but unique ones.

Then we have to save a copy of palo alto app and make modifications in locals to fit Cortex sourcing data...