Support for the 'Authentication' and 'Network Session' data models on the Splunk_TA_paloalto

[jwiedow]

Are there plans to add support for the 'Network Sessions' and 'Authentication' CIM data models from the Splunk_TA_paloalto Add-on for globalprotect events?

[btorresgil · Accepted solution]

Yes, there are plans to do this and other improvements to CIM datamodel for better ES integration. Keep an eye out in the next couple Add-on releases. Thanks for the feedback!

[jwiedow]

Thank you Brian. Do you have a road map or a time frame for when this support will be added?

[saurabh_tek11]

Its been 2 years for this answer! @btorresgil

[btorresgil]

Hi saurabh_tek11, thanks for bumping this. We support network sessions, see eventtype=pan_traffic_start and pan_traffic_end. We could support Authentication to some extent with USERID type logs from the firewall, but the Authentication CIM is not a great fit because it's geared more toward the logs from the actual point of authentication, which the firewall typically is not in enterprise environments. This would be your RADIUS, LDAP, or AD server usually.

I opened a feature request so you can share your use cases for supporting the Authentication CIM. I'm very interested in any feedback, thanks!
https://github.com/PaloAltoNetworks/Splunk_TA_paloalto/issues/33

[florin]

tcp start and end are not suppose to be mapped to Network Sessions Datamodel (CIM) according to Splunk:
https://docs.splunk.com/Documentation/CIM/5.3.1/User/NetworkSessions:

"The fields in the Network Sessions data model describe Dynamic Host Configuration Protocol (DHCP) and Virtual Private Network (VPN) traffic, whether server:server or client:server, and network infrastructure inventory and topology."

Globalprotect logs should be the ones mapped to Network Sessions - VPN