All Apps and Add-ons

Palo Alto Networks App (version 6.1.1): How to set up host field using Log Forwarding App for Cortex?

madsrc
New Member

Using SplunkCloud, we have version 6.1.1 of both the App and the Add-on installed.

I'm seeing that Palo Alto logs aren't getting the host field set correctly. Everything else seems to be parsed correctly.

We're receiving the data, forwarded using the Log Forwarding App for Cortex. Upon receiving the data, we're extracting the time and host name from the raw syslog event, and sending it to Splunk using the HEC input (using the extracted time as value to _time, extracted host name as host and the raw syslog event, as received by Cortex, as event).

Initially, we thought that we'd be able to extract the host name easily, as syslog is pretty clear about what field it should appear in. Unfortunately, when data is forwarded from Cortex, the instance on which the Log Forwarder is running is written to the host field.

Thus, by parsing the syslogs for host name and setting it in the Splunk HEC data, we're effectively setting the same host field for every log (logforwarder-somethingsenseless).

Given that Cortex apparently doesn't send the raw events, I would have assumed that the Splunk Add-on or TA would parse and rewrite the host field, but that isn't the case.

Is our setup of Cortex->Syslog->HEC not supported or is there something else we need to (re)configure in order for Splunk to set the correct host field?

Edit: After looking through the App and Add-on source, I don't see the host field being set anywhere.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...