All Apps and Add-ons

Palo Alto firewall: FIFO?

jasongb
Path Finder

I am a noob to Enterprise Security.

We recently had a PA event, and the matter of FIFO exceptions for PA devices came up. Someone observed that it would be pretty cool if we could alert on that, and then someone else said, "Sadly, PA firewalls don't let us see that data."

I am neither a network engineer nor an Enterprise Security, but I did poke around online and found a question related to a PA metric (https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLJ7CAO) 'rcv_fifo_overrun'.

Can anyone direct me to a query or data model that contains that field?

Labels (1)
0 Karma
1 Solution

jasongb
Path Finder

Self-answered: that field is not logged by the devices, and would require significant efforts by PA to do so. It's not likely to be made available.

Apparently, the field is available if you query the device via its API. I'm looking into creating a script that will do so, creating a log file in the process. 

The data is highly valuable - although it will primarily be an indication of bursty traffic (no big deal), it can also be an alarm bell for more significant problems.

View solution in original post

0 Karma

jasongb
Path Finder

Self-answered: that field is not logged by the devices, and would require significant efforts by PA to do so. It's not likely to be made available.

Apparently, the field is available if you query the device via its API. I'm looking into creating a script that will do so, creating a log file in the process. 

The data is highly valuable - although it will primarily be an indication of bursty traffic (no big deal), it can also be an alarm bell for more significant problems.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...