All Apps and Add-ons

Palo Alto Networks App: How to disable Wildfire API Key query

DEAD_BEEF
Builder

Looking in splunkd.log I noticed these two errors repeated thousands of times. It looks like the Palo Alto app is trying to query for the Wildfire api key, but we do not use the Wildfire service here. How can I go about disabling this? I did see this posted, but that is already disabled and I am still seeing this error.

index=_internal sourcetype=splunk_python

.

ERROR common:183 - No Wildfire API key is set, set apikey in App configuration.

ERROR common:182 -   File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/retrieveWildFireReport.py", line 143, in <module>
    main_splunk()
  File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/retrieveWildFireReport.py", line 116, in main_splunk
    wf_apikey = common.get_wildfire_apikey(sessionKey)
  File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/lib/common.py", line 98, in get_wildfire_apikey
    exit_with_error("No Wildfire API key is set, set apikey in App configuration.")
  File "/opt/splunk/etc/apps/SplunkforPaloAltoNetworks/bin/lib/common.py", line 182, in exit_with_error
    logger.error(''.join(traceback.format_stack()))
0 Karma
1 Solution

DEAD_BEEF
Builder

After some back and forth troubleshooting, I believe I have found the solution:

I noticed that there was an accelerated data model (Settings > Data Model) called "Palo Alto Networks WildFire Malware Reports". I disabled the acceleration and schedule. Then I went to Settings > Searches, reports, and alerts and found "WildFire Reports - Retrieve Report" and disabled that.

View solution in original post

0 Karma

DEAD_BEEF
Builder

After some back and forth troubleshooting, I believe I have found the solution:

I noticed that there was an accelerated data model (Settings > Data Model) called "Palo Alto Networks WildFire Malware Reports". I disabled the acceleration and schedule. Then I went to Settings > Searches, reports, and alerts and found "WildFire Reports - Retrieve Report" and disabled that.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...