Splunk for Palo Alto Networks: How to limit permissions for users by log type?

[ckillg]

I would like to limit certain users' access to URL filtering and config change data coming from the PAN. Is there a way to do that?

I would put the data in separate indexes, but the app documentation says to use pan_logs for everything.

[jnussbaum_splun · Accepted solution]

Under Access Controls -> Roles , you can restrict search terms and exclude eventtypes such as you're mentioning above with:
index=pan_logs eventtype!=pan_config eventtype!=pan_threat
This will allow the Role to search the pan_logs index, but not events that fall into the eventtype of pan_config and pan_threat. Hope that's what you're looking for.

[ckillg]

Perfect. Thanks.