Palo Alto Networks Add-on for Splunk: Why is the pan_endpoint stanza missing in tags.conf?

[tclark_splunk]

In the Palo Alto Networks Add-on for Splunk (Splunk_TA_paloalto) version 3.7.1, the pan_endpoint stanza is missing tags in the event types.conf file, and the pan_endpoint stanza is missing altogether in the tags.conf file. Why?

[tclark_splunk · Accepted solution]

This isn't an answer to the question, but is how I dealt with the issue: I added the [pan_endpoint] stanza to the bottom of the tags.conf file in the local directory; I added 3 tags (malware, attack and operations) and I then disabled them. I did this as I had no data to drive the associated pan_endpoint search.